@kehto/paja 0.15.2 → 0.16.1

package/dist/browser-host.js

@@ -638,7 +638,7 @@ function deserialize2(json) {
   return defaultConfig();
 }
 
-// ../../node_modules/.pnpm/@napplet+core@0.31.1/node_modules/@napplet/core/dist/index.js
+// ../../node_modules/.pnpm/@napplet+core@0.32.0/node_modules/@napplet/core/dist/index.js
 function createDispatch() {
   const handlers = /* @__PURE__ */ new Map();
   function registerNap2(domain, handler) {
@@ -4802,11 +4802,21 @@ function nappletNamespacePrelude(domains) {
   }
   function makeResource() {
     const objectUrls = /* @__PURE__ */ new Set();
-    const bytes = (url) => request({ type: "resource.bytes", url }, "resource.bytes.result", (msg) => msg.blob);
+    const bytes = (url, options) => request({
+      type: "resource.bytes",
+      url,
+      ...Array.isArray(options?.servers) ? { servers: Array.from(options.servers) } : {}
+    }, "resource.bytes.result", (msg) => msg.blob);
     return {
       info: () => request({ type: "resource.info" }, "resource.info.result", (msg) => msg.info),
       bytes,
-      bytesMany: (urls) => request({ type: "resource.bytesMany", urls }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : []),
+      bytesMany: (requests) => request({
+        type: "resource.bytesMany",
+        requests: Array.from(requests || [], (entry) => ({
+          url: entry.url,
+          ...Array.isArray(entry.servers) ? { servers: Array.from(entry.servers) } : {}
+        }))
+      }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : []),
       bytesAsObjectURL(url) {
         let objectUrl = "";
         const handle = {
@@ -11155,7 +11165,8 @@ function normalizeResourceInfo(info) {
   return {
     schemes: Array.isArray(info.schemes) ? info.schemes.filter((scheme) => typeof scheme?.scheme === "string").map((scheme) => ({ scheme: scheme.scheme, enabled: scheme.enabled !== false })) : [],
     ...typeof info.maxBytes === "number" ? { maxBytes: info.maxBytes } : {},
-    ...typeof info.maxUrls === "number" ? { maxUrls: info.maxUrls } : {}
+    ...typeof info.maxUrls === "number" ? { maxUrls: info.maxUrls } : {},
+    ...typeof info.maxServers === "number" ? { maxServers: info.maxServers } : {}
   };
 }
 async function resolveResourceInfo(options, windowId) {
@@ -11194,10 +11205,11 @@ function classifyResourceFailure(error) {
     message: error instanceof Error ? error.message : String(error)
   };
 }
-async function fetchResourceItem(options, windowId, info, url, signal) {
+async function fetchResourceItem(options, windowId, info, request, signal) {
+  const { url } = request;
   const parsedUrl = parseResourceUrl(url);
   if (!parsedUrl) return resourceInvalidRequest(url, `invalid URL: ${url}`);
-  if (options.isOriginGranted && options.getConnectGrants) {
+  if (parsedUrl.origin !== "null" && options.isOriginGranted && options.getConnectGrants) {
     const identity = options.resolveIdentity?.(windowId) ?? null;
     if (!identity) {
       return {
@@ -11221,7 +11233,9 @@ async function fetchResourceItem(options, windowId, info, url, signal) {
   try {
     const response = await options.fetch(url, {
       method: "GET",
-      signal
+      signal,
+      windowId,
+      ...parsedUrl.protocol === "blossom:" && request.servers !== void 0 ? { servers: [...request.servers] } : {}
     });
     const buffer = await response.arrayBuffer();
     if (info.maxBytes !== void 0 && buffer.byteLength > info.maxBytes) {
@@ -11245,12 +11259,12 @@ async function fetchResourceItem(options, windowId, info, url, signal) {
   }
 }
 async function handleBytes(options, state, windowId, msg, send) {
-  const { requestId, url } = msg;
+  const { requestId, ...request } = msg;
   const controller = new AbortController();
   trackRequest(state, requestId, windowId, controller);
   try {
     const info = await resolveResourceInfo(options, windowId);
-    const item = await fetchResourceItem(options, windowId, info, url, controller.signal);
+    const item = await fetchResourceItem(options, windowId, info, request, controller.signal);
     if (controller.signal.aborted) return;
     if (!item.ok) {
       sendResourceError(send, requestId, item.message, item.error);
@@ -11272,9 +11286,9 @@ async function handleBytes(options, state, windowId, msg, send) {
   }
 }
 async function handleBytesMany(options, state, windowId, msg, send) {
-  const { requestId, urls } = msg;
-  if (!Array.isArray(urls) || urls.length === 0 || urls.some((url) => typeof url !== "string")) {
-    sendBytesManyError(send, requestId, "resource.bytesMany requires a non-empty urls array", "invalid-request");
+  const { requestId, requests } = msg;
+  if (!isResourceRequestList(requests)) {
+    sendBytesManyError(send, requestId, "resource.bytesMany requires a non-empty requests array", "invalid-request");
     return;
   }
   let info;
@@ -11285,7 +11299,7 @@ async function handleBytesMany(options, state, windowId, msg, send) {
     sendBytesManyError(send, requestId, failure3.message, failure3.error);
     return;
   }
-  if (info.maxUrls !== void 0 && urls.length > info.maxUrls) {
+  if (info.maxUrls !== void 0 && requests.length > info.maxUrls) {
     sendBytesManyError(send, requestId, `resource.bytesMany exceeds ${info.maxUrls} URLs`, "too-large");
     return;
   }
@@ -11293,8 +11307,8 @@ async function handleBytesMany(options, state, windowId, msg, send) {
   trackRequest(state, requestId, windowId, controller);
   try {
     const items = [];
-    for (const url of urls) {
-      const item = await fetchResourceItem(options, windowId, info, url, controller.signal);
+    for (const request of requests) {
+      const item = await fetchResourceItem(options, windowId, info, request, controller.signal);
       if (controller.signal.aborted) return;
       if (item.ok) {
         items.push({
@@ -11326,6 +11340,12 @@ async function handleBytesMany(options, state, windowId, msg, send) {
     untrackRequest(state, windowId, requestId);
   }
 }
+function hasValidServerHints(request) {
+  return request.servers === void 0 || Array.isArray(request.servers) && request.servers.every((server) => typeof server === "string");
+}
+function isResourceRequestList(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((request) => typeof request === "object" && request !== null && typeof request.url === "string" && hasValidServerHints(request));
+}
 function handleCancel(state, windowId, requestId) {
   const entry = state.inFlight.get(requestKey(windowId, requestId));
   if (entry) {
@@ -11363,11 +11383,15 @@ function createResourceService(options) {
           const m = message;
           const requestId = requestIdFromMessage(m);
           if (!requestId) return;
-          if (typeof m.url !== "string") {
-            sendResourceError(send, requestId, "resource.bytes requires a URL", "invalid-request");
+          if (typeof m.url !== "string" || !hasValidServerHints(m)) {
+            sendResourceError(send, requestId, "resource.bytes requires a URL and optional string servers", "invalid-request");
             return;
           }
-          handleBytes(options, state, windowId, { requestId, url: m.url }, send).catch(() => {
+          handleBytes(options, state, windowId, {
+            requestId,
+            url: m.url,
+            ...m.servers !== void 0 ? { servers: [...m.servers] } : {}
+          }, send).catch(() => {
           });
           return;
         }
@@ -11383,7 +11407,7 @@ function createResourceService(options) {
           const m = message;
           const requestId = requestIdFromMessage(m);
           if (!requestId) return;
-          handleBytesMany(options, state, windowId, { requestId, urls: m.urls ?? [] }, send).catch(() => {
+          handleBytesMany(options, state, windowId, { requestId, requests: m.requests ?? [] }, send).catch(() => {
           });
           return;
         }
@@ -11524,7 +11548,7 @@ function createOutboxService(options) {
   if (!options || typeof options.router !== "object" || options.router === null) {
     throw new Error("createOutboxService: options.router is required");
   }
-  const { router, getQueryRouter } = options;
+  const { router, getReadRouter, getQueryRouter } = options;
   let runtimeContext;
   const subscriptions = /* @__PURE__ */ new Map();
   function handleQuery(windowId, msg, send) {
@@ -11535,7 +11559,7 @@ function createOutboxService(options) {
       send({ type: "outbox.query.result", id, events: [], error: "invalid filter" });
       return;
     }
-    const queryRouter = getQueryRouter?.(windowId, runtimeContext) ?? router;
+    const queryRouter = getQueryRouter?.(windowId, runtimeContext) ?? getReadRouter?.(windowId, runtimeContext) ?? router;
     void queryRouter.query(filters, sanitizeQueryOptions(m.options)).then(
       (result2) => send({
         type: "outbox.query.result",
@@ -11567,7 +11591,8 @@ function createOutboxService(options) {
         send({ type: "outbox.closed", subId, ...reason === void 0 ? {} : { reason } });
       }
     };
-    subscriptions.set(subKey, router.subscribe(filters, sanitizeSubscribeOptions(m.options), sink));
+    const readRouter = getReadRouter?.(windowId, runtimeContext) ?? router;
+    subscriptions.set(subKey, readRouter.subscribe(filters, sanitizeSubscribeOptions(m.options), sink));
   }
   function handleClose(windowId, msg, send) {
     const m = msg;
@@ -11622,7 +11647,7 @@ function createOutboxService(options) {
     handleMessage(windowId, message, send) {
       switch (message.type) {
         case "outbox.getEvent":
-          handleGetEvent(router, message, send);
+          handleGetEvent(getReadRouter?.(windowId, runtimeContext) ?? router, message, send);
           return;
         case "outbox.query":
           handleQuery(windowId, message, send);
@@ -16243,2179 +16268,2498 @@ function cancelled2(uploadId) {
   return { ok: false, uploadId, status: "cancelled", rail: "blossom", error: "user cancelled" };
 }
 
-// ../nip/dist/chunk-PSENX3MS.js
-function parseNip65RelayList(event) {
-  return event.tags.flatMap((tag) => {
-    if (tag[0] !== "r" || typeof tag[1] !== "string" || tag[1].length === 0) return [];
-    const marker = tag[2];
-    const read = marker !== "write";
-    const write = marker !== "read";
-    return [{ url: tag[1], read, write }];
-  });
-}
-function selectWriteRelays(entries) {
-  return dedupe(entries.filter((e) => e.write).map((e) => e.url));
-}
-function selectReadRelays(entries) {
-  return dedupe(entries.filter((e) => e.read).map((e) => e.url));
+// ../nip/dist/chunk-JT5WCCCX.js
+function computeAggregateHash(entries) {
+  const lines = entries.map((entry) => `${entry.sha256} ${entry.path}
+`);
+  lines.sort();
+  return bytesToHex2(sha256(new TextEncoder().encode(lines.join(""))));
 }
-function createNip65Registry() {
-  const lists = /* @__PURE__ */ new Map();
-  function setRelayList(pubkey2, entries) {
-    lists.set(pubkey2, entries.map((e) => ({ ...e })));
-  }
-  function ingest(event) {
-    const entries = parseNip65RelayList(event);
-    setRelayList(event.pubkey, entries);
-    return entries;
-  }
-  function getRelayList(pubkey2) {
-    const entries = lists.get(pubkey2);
-    return entries ? entries.map((e) => ({ ...e })) : void 0;
-  }
-  function resolve(pubkeys, want) {
-    const urls = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const pubkey2 of pubkeys) {
-      const entries = lists.get(pubkey2);
-      if (!entries) continue;
-      for (const entry of entries) {
-        if (entry[want] && !seen.has(entry.url)) {
-          seen.add(entry.url);
-          urls.push(entry.url);
-        }
-      }
+function pathEntriesFromTags(tags) {
+  const entries = [];
+  for (const tag of tags) {
+    if (tag[0] === "path" && typeof tag[1] === "string" && typeof tag[2] === "string" && tag[1].length > 0 && tag[2].length > 0) {
+      entries.push({ path: tag[1], sha256: tag[2] });
     }
-    return urls;
   }
-  return {
-    ingest,
-    setRelayList,
-    getRelayList,
-    has: (pubkey2) => lists.has(pubkey2),
-    resolveOutboxRelays: (pubkeys) => resolve(pubkeys, "write"),
-    resolveReadRelays: (pubkeys) => resolve(pubkeys, "read"),
-    delete: (pubkey2) => lists.delete(pubkey2),
-    clear: () => lists.clear()
-  };
+  return entries;
 }
-function dedupe(urls) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const url of urls) {
-    if (!seen.has(url)) {
-      seen.add(url);
-      out.push(url);
+function aggregateTagValue(tags) {
+  for (const tag of tags) {
+    if (tag[0] === "x" && tag[2] === "aggregate" && typeof tag[1] === "string" && tag[1].length > 0) {
+      return tag[1];
     }
   }
-  return out;
+  return void 0;
 }
 
-// src/browser-relay-runtime.ts
-var PAJA_NIP65_RELAY_LIST_KIND = 10002;
-var PAJA_CONTACT_LIST_KIND = 3;
-var PAJA_WEBRTC_SIGNAL_KIND = 25050;
-var NIP17_GIFT_WRAP_KIND2 = 1059;
-var PAJA_CONTACT_LIST_CANDIDATE_LIMIT = 64;
-var PAJA_LIVE_QUERY_WAIT_MS = 4e3;
-var contactListCandidateQueries = /* @__PURE__ */ new WeakMap();
-function matchesFilter2(event, filter) {
-  const ids = filter.ids;
-  if (ids && !ids.some((id) => event.id === id || event.id.startsWith(id))) return false;
-  const authors = filter.authors;
-  if (authors && !authors.some((author) => event.pubkey === author || event.pubkey.startsWith(author))) return false;
-  const kinds = filter.kinds;
-  if (kinds && !kinds.includes(event.kind)) return false;
-  if (typeof filter.since === "number" && event.created_at < filter.since) return false;
-  if (typeof filter.until === "number" && event.created_at > filter.until) return false;
-  for (const [key, value] of Object.entries(filter)) {
-    if (!key.startsWith("#") || !Array.isArray(value)) continue;
-    const tagName = key.slice(1);
-    const allowed2 = value.filter((item) => typeof item === "string");
-    if (allowed2.length === 0) continue;
-    if (!event.tags.some((tag) => tag[0] === tagName && typeof tag[1] === "string" && allowed2.includes(tag[1]))) return false;
-  }
-  return true;
+// ../nip/dist/chunk-F6ABV5KZ.js
+var MIB = 1024 * 1024;
+var NAPPLET_ARTIFACT_CACHE_NAME = "kehto:napplet-artifacts:v1";
+var SCHEMA_VERSION = 1;
+var DEFAULT_BASE_URL = "https://kehto.invalid";
+var DEFAULT_UNKNOWN_BUDGET_BYTES = 32 * MIB;
+var DEFAULT_SOFT_CEILING_BYTES = 128 * MIB;
+var DEFAULT_HARD_CEILING_BYTES = 256 * MIB;
+var DEFAULT_FOREGROUND_TTL_MS = 15 * 60 * 1e3;
+var DEFAULT_BACKGROUND_TTL_MS = 60 * 60 * 1e3;
+function emptyIndex(now2) {
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    updatedAt: now2,
+    blobs: {},
+    aggregates: {},
+    coordinates: {}
+  };
 }
-function matchesAnyFilter2(event, filters) {
-  return filters.length === 0 || filters.some((filter) => matchesFilter2(event, filter));
+function aggregateKey(dTag, aggregateHash) {
+  return `${encodeURIComponent(dTag)}:${aggregateHash}`;
 }
-function normalizedFilters(filters) {
-  return Array.isArray(filters) ? filters : [filters];
+function coordinateKey(kind, pubkey2, dTag) {
+  return `${kind}:${pubkey2}:${encodeURIComponent(dTag)}`;
 }
-function applyFilterLimit(events, filter) {
-  const limit = typeof filter.limit === "number" && filter.limit >= 0 ? filter.limit : void 0;
-  if (limit === void 0) return events;
-  return [...events].sort((a, b) => b.created_at - a.created_at).slice(0, limit);
+function isCoordinateFresh(coordinate, options = {}) {
+  const now2 = options.now ?? Date.now();
+  const ttl = options.background ? coordinate.backgroundTtlMs : coordinate.foregroundTtlMs;
+  return ttl === Number.POSITIVE_INFINITY || now2 - coordinate.lastResolvedAt <= ttl;
 }
-function collectMemoryEvents(events, filters) {
-  const out = /* @__PURE__ */ new Map();
-  const activeFilters = filters.length > 0 ? filters : [{}];
-  for (const filter of activeFilters) {
-    for (const event of applyFilterLimit(events.filter((candidate) => matchesFilter2(candidate, filter)), filter)) {
-      out.set(event.id, event);
-    }
-  }
-  return [...out.values()].sort((a, b) => b.created_at - a.created_at);
+function byteLength2(bytes) {
+  return bytes.byteLength;
 }
-function subscribeLive(pool, relayUrls2, filters, next) {
-  const activeFilters = filters.length > 0 ? filters : [{}];
-  const requests = relayUrls2.flatMap((url) => activeFilters.map((filter) => ({ url, filter })));
-  if (requests.length === 0) {
-    queueMicrotask(() => next("EOSE"));
-    return { unsubscribe() {
-    } };
-  }
-  const sub = pool.subscribeMap(requests, {
-    label: "kehto-paja-runtime",
-    maxWait: PAJA_LIVE_QUERY_WAIT_MS,
-    onevent: (event) => next(event),
-    oneose: () => next("EOSE")
-  });
-  return {
-    unsubscribe() {
-      void sub.close("paja unsubscribe");
-    }
-  };
+function encodeKeyPart(value) {
+  return encodeURIComponent(value).replaceAll("%2F", "%252F");
 }
-function queryLiveBounded(pool, relayUrls2, filter, maxWaitMs, limit, signal) {
-  if (limit === 0 || signal?.aborted) return Promise.resolve([]);
-  return new Promise((resolve) => {
-    const events = [];
-    let settled = false;
-    let closeRequested = false;
-    let closeReason = "paja query limit reached";
-    let subscription;
-    let abort;
-    const finish = () => {
-      if (settled) return;
-      settled = true;
-      if (abort) signal?.removeEventListener("abort", abort);
-      resolve(events);
-    };
-    const close = (reason = closeReason) => {
-      closeRequested = true;
-      closeReason = reason;
-      if (!subscription) return;
-      void Promise.resolve(subscription.close(reason)).catch(() => {
-      });
-      finish();
-    };
-    abort = () => close("paja query aborted");
-    signal?.addEventListener("abort", abort, { once: true });
-    subscription = pool.subscribeEose(relayUrls2, filter, {
-      label: "kehto-paja-runtime",
-      maxWait: maxWaitMs,
-      onevent(event) {
-        if (events.length >= limit) return;
-        events.push(event);
-        if (events.length === limit) close();
-      },
-      onclose: finish
-    });
-    if (closeRequested) close();
-  });
+function cloneBytes(bytes) {
+  return new Uint8Array(bytes);
 }
-async function queryLive(pool, relayUrls2, filters, maxWaitMs = PAJA_LIVE_QUERY_WAIT_MS, collectUntilLimit = false, signal) {
-  const activeFilters = filters.length > 0 ? filters : [{}];
-  const batches = await Promise.all(activeFilters.map((filter) => {
-    const limit = typeof filter.limit === "number" && filter.limit >= 0 ? filter.limit : void 0;
-    if (collectUntilLimit && limit !== void 0) return queryLiveBounded(pool, relayUrls2, filter, maxWaitMs, limit, signal);
-    return pool.querySync(relayUrls2, filter, {
-      label: "kehto-paja-runtime",
-      maxWait: maxWaitMs
-    });
-  }));
-  const out = /* @__PURE__ */ new Map();
-  for (const event of batches.flat()) out.set(event.id, event);
-  return [...out.values()].sort((a, b) => b.created_at - a.created_at);
+function responseBody(bytes) {
+  return cloneBytes(bytes).buffer;
 }
-async function publishLive(pool, relayUrls2, event) {
-  const results = await Promise.allSettled(pool.publish(relayUrls2, event));
-  return Object.fromEntries(relayUrls2.map((relayUrl2, index) => [relayUrl2, results[index]?.status === "fulfilled"]));
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
 }
-async function countLive(pool, relayUrls2, filters) {
-  let failure3 = new Error("count unavailable");
-  for (const relayUrl2 of relayUrls2) {
-    const controller = new AbortController();
-    let timeout;
-    const timedOut = new Promise((_resolve, reject2) => {
-      timeout = setTimeout(() => {
-        controller.abort();
-        reject2(new Error("count timeout"));
-      }, PAJA_LIVE_QUERY_WAIT_MS);
-    });
-    try {
-      const relay = await Promise.race([
-        pool.ensureRelay(relayUrl2, {
-          connectionTimeout: PAJA_LIVE_QUERY_WAIT_MS,
-          abort: controller.signal
-        }),
-        timedOut
-      ]);
-      const count = await Promise.race([
-        relay.count(filters, { id: null }),
-        timedOut
-      ]);
-      if (!Number.isSafeInteger(count) || count < 0) throw new Error("invalid count");
-      return { count, relay: relayUrl2 };
-    } catch (error) {
-      failure3 = error;
-    } finally {
-      if (timeout !== void 0) clearTimeout(timeout);
-    }
+function resolveBaseUrl(baseUrl) {
+  if (baseUrl) return normalizeBaseUrl(baseUrl);
+  const maybeLocation = globalThis;
+  if (maybeLocation.location?.origin) return normalizeBaseUrl(maybeLocation.location.origin);
+  return normalizeBaseUrl(DEFAULT_BASE_URL);
+}
+async function responseBytes(response) {
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function responseJson(response) {
+  return response.json();
+}
+function refCounts(index) {
+  const counts = {};
+  for (const aggregate of Object.values(index.aggregates)) {
+    for (const hash of aggregate.blobHashes) counts[hash] = (counts[hash] ?? 0) + 1;
   }
-  throw failure3;
+  return counts;
 }
-function createPajaRelayBackend(getSimulation, confirmRequest, livePool = new SimplePool()) {
-  livePool.trackRelays = true;
-  const fixtureEvents = getSimulation().relay.fixtures.flatMap(toNostrEvent);
-  const acceptedMemoryEvents = [];
-  const subscribers = /* @__PURE__ */ new Set();
-  const isAvailable = () => getSimulation().relay.mode !== "disabled" && getPajaRelayUrls(getSimulation()).length > 0;
-  const cachedEvents = () => getSimulation().relay.mode === "memory" ? [...fixtureEvents, ...acceptedMemoryEvents] : [];
-  const query = async (relayUrls2, filters, maxWaitMs) => {
-    const cached = collectMemoryEvents(cachedEvents(), filters);
-    if (getSimulation().relay.mode !== "live" || relayUrls2.length === 0) return cached;
-    const liveEvents = await queryLive(livePool, relayUrls2, filters, maxWaitMs);
-    const out = /* @__PURE__ */ new Map();
-    for (const event of [...cached, ...liveEvents]) out.set(event.id, event);
-    return [...out.values()].sort((a, b) => b.created_at - a.created_at);
-  };
-  const queryContactListCandidates = async (relayUrls2, filters, maxWaitMs, signal) => {
-    const cached = collectMemoryEvents(cachedEvents(), filters);
-    if (signal?.aborted || getSimulation().relay.mode !== "live" || relayUrls2.length === 0) return cached;
-    const liveEvents = await queryLive(livePool, relayUrls2, filters, maxWaitMs, true, signal);
-    const out = /* @__PURE__ */ new Map();
-    for (const event of [...cached, ...liveEvents]) out.set(event.id, event);
-    return [...out.values()].sort((a, b) => b.created_at - a.created_at);
-  };
-  function retainPublishedEvent(event, mode) {
-    if (mode !== "memory") return;
-    acceptedMemoryEvents.push(event);
-    for (const subscriber of subscribers) {
-      if (matchesAnyFilter2(event, subscriber.filters)) subscriber.next(event);
+function cachedSize(index) {
+  const blobBytes = Object.values(index.blobs).reduce((sum, entry) => sum + entry.size, 0);
+  const aggregateBytes = Object.values(index.aggregates).reduce((sum, entry) => sum + entry.size, 0);
+  return blobBytes + aggregateBytes;
+}
+var CacheStorageNappletArtifactCache = class {
+  cacheStorage;
+  storage;
+  cacheName;
+  baseUrl;
+  now;
+  activeAggregates = /* @__PURE__ */ new Set();
+  onDiagnostic;
+  unknownBudgetBytes;
+  softCeilingBytes;
+  hardCeilingBytes;
+  cachePromise;
+  constructor(options = {}) {
+    const maybeCacheStorage = options.cacheStorage ?? globalThis.caches;
+    if (!maybeCacheStorage) {
+      throw new Error("Cache Storage is unavailable");
     }
+    this.cacheStorage = maybeCacheStorage;
+    this.storage = options.storage ?? globalThis.navigator?.storage;
+    this.cacheName = options.cacheName ?? NAPPLET_ARTIFACT_CACHE_NAME;
+    this.baseUrl = resolveBaseUrl(options.baseUrl);
+    this.now = options.now ?? Date.now;
+    this.onDiagnostic = options.onDiagnostic;
+    this.unknownBudgetBytes = options.unknownBudgetBytes ?? DEFAULT_UNKNOWN_BUDGET_BYTES;
+    this.softCeilingBytes = options.softCeilingBytes ?? DEFAULT_SOFT_CEILING_BYTES;
+    this.hardCeilingBytes = options.hardCeilingBytes ?? DEFAULT_HARD_CEILING_BYTES;
   }
-  async function attemptPublish(relayUrls2, event) {
-    const simulation = getSimulation();
-    const rejected = Object.fromEntries(relayUrls2.map((url) => [url, false]));
-    if (simulation.relay.mode === "disabled") {
-      return { outcomes: rejected, error: "relay unavailable" };
-    }
-    if (!await confirmRequest({ action: "publish", event })) {
-      return { outcomes: rejected, error: "publish denied" };
+  async readBlob(sha256Hex) {
+    try {
+      const cache2 = await this.open();
+      const response = await cache2.match(this.blobUrl(sha256Hex));
+      if (!response) return void 0;
+      const bytes = await responseBytes(response);
+      const index = await this.readIndex(cache2);
+      const entry = index.blobs[sha256Hex];
+      if (entry) {
+        entry.lastAccessed = this.now();
+        index.updatedAt = entry.lastAccessed;
+        await this.writeIndex(cache2, index);
+      }
+      return bytes;
+    } catch (cause) {
+      this.diagnostic({ type: "cache-read-failed", message: `failed to read blob ${sha256Hex}`, cause });
+      return void 0;
     }
-    const outcomes = simulation.relay.mode === "live" ? await publishLive(livePool, relayUrls2, event) : Object.fromEntries(relayUrls2.map((url) => [url, true]));
-    if (!Object.values(outcomes).some(Boolean)) {
-      return { outcomes, error: "publish failed" };
+  }
+  async deleteBlob(sha256Hex) {
+    try {
+      const cache2 = await this.open();
+      await cache2.delete(this.blobUrl(sha256Hex));
+      const index = await this.readIndex(cache2);
+      delete index.blobs[sha256Hex];
+      index.updatedAt = this.now();
+      await this.writeIndex(cache2, index);
+    } catch (cause) {
+      this.diagnostic({ type: "cache-delete-failed", message: `failed to delete blob ${sha256Hex}`, cause });
     }
-    retainPublishedEvent(event, simulation.relay.mode);
-    return { outcomes };
   }
-  const backend = {
-    subscription(relayUrls2, filtersInput) {
-      return {
-        subscribe(next) {
-          const filters = normalizedFilters(filtersInput);
-          const subscriber = {
-            filters,
-            next: (item) => next(item)
-          };
-          subscribers.add(subscriber);
-          for (const event of collectMemoryEvents(cachedEvents(), filters)) next(event);
-          const liveSub = getSimulation().relay.mode === "live" ? subscribeLive(livePool, relayUrls2, filters, subscriber.next) : null;
-          queueMicrotask(() => {
-            if (subscribers.has(subscriber) && !liveSub) next("EOSE");
-          });
-          return {
-            unsubscribe() {
-              subscribers.delete(subscriber);
-              liveSub?.unsubscribe();
-            }
-          };
-        }
-      };
-    },
-    async publish(relayUrls2, event) {
-      const attempt = await attemptPublish(relayUrls2, event);
-      if (attempt.error) throw new Error(attempt.error);
-    },
-    request(relayUrls2, filtersInput) {
-      return {
-        subscribe(observer) {
-          const filters = normalizedFilters(filtersInput);
-          let active = true;
-          query(relayUrls2, filters).then((matched) => {
-            if (!active) return;
-            for (const event of matched) observer.next(event);
-            observer.complete();
-          }).catch(() => {
-            if (active) observer.error();
-          });
-          return { unsubscribe() {
-            active = false;
-          } };
-        }
-      };
-    },
-    async count(relayUrls2, filters) {
-      if (getSimulation().relay.mode !== "live") throw new Error("count unavailable");
-      return (await countLive(livePool, relayUrls2, normalizedFilters(filters))).count;
-    },
-    async countWithRelay(relayUrls2, filters) {
-      if (getSimulation().relay.mode !== "live") throw new Error("count unavailable");
-      return countLive(livePool, relayUrls2, normalizedFilters(filters));
-    },
-    observedRelayUrls(eventId) {
-      return [...livePool.seenOn?.get(eventId) ?? []].map((relay) => relay.url);
-    },
-    query,
-    async publishToRelays(relayUrls2, event) {
-      return (await attemptPublish(relayUrls2, event)).outcomes;
-    },
-    async publishWebrtcSignal(relayUrls2, event) {
-      if (getSimulation().relay.mode !== "live" || relayUrls2.length === 0 || event.kind !== PAJA_WEBRTC_SIGNAL_KIND || !verifyEvent(event)) {
-        throw new Error("signaling unavailable");
-      }
-      const outcomes = await publishLive(livePool, relayUrls2, event);
-      if (!Object.values(outcomes).some(Boolean)) throw new Error("signaling unavailable");
-      retainPublishedEvent(event, "live");
-    },
-    async publishDmGiftWrap(relayUrls2, event) {
-      if (getSimulation().relay.mode !== "live" || relayUrls2.length === 0 || event.kind !== NIP17_GIFT_WRAP_KIND2 || !verifyEvent(event)) {
-        throw new Error("DM relay publication failed");
+  async writeVerifiedResolution(input) {
+    try {
+      await this.writeVerifiedResolutionOnce(input);
+    } catch (firstCause) {
+      try {
+        await this.prune(input.now ?? this.now());
+        await this.writeVerifiedResolutionOnce(input);
+      } catch (cause) {
+        this.diagnostic({
+          type: "cache-write-failed",
+          message: "failed to write verified napplet artifacts after prune retry",
+          cause: cause ?? firstCause
+        });
       }
-      const outcomes = await publishLive(livePool, relayUrls2, event);
-      if (!Object.values(outcomes).some(Boolean)) throw new Error("DM relay publication failed");
-      retainPublishedEvent(event, "live");
-    },
-    isAvailable,
-    close() {
-      livePool.destroy();
     }
-  };
-  contactListCandidateQueries.set(backend, queryContactListCandidates);
-  return backend;
-}
-function toNostrEvent(value) {
-  if (typeof value === "object" && value !== null && typeof value.id === "string" && typeof value.pubkey === "string" && typeof value.kind === "number" && Array.isArray(value.tags) && typeof value.content === "string" && typeof value.sig === "string") {
-    return [value];
   }
-  return [];
-}
-function getPajaRelayUrls(simulation) {
-  return simulation.relay.mode === "disabled" ? [] : [...simulation.relay.urls];
-}
-function dedupeRelayUrls(urls) {
-  const out = /* @__PURE__ */ new Set();
-  for (const url of urls) {
-    const trimmed = url.trim();
-    if (trimmed.length > 0) out.add(trimmed);
+  async writeCoordinate(input) {
+    const cache2 = await this.open();
+    const now2 = this.now();
+    const index = await this.readIndex(cache2);
+    const key = coordinateKey(input.kind, input.pubkey, input.dTag);
+    index.coordinates[key] = {
+      key,
+      kind: input.kind,
+      pubkey: input.pubkey,
+      dTag: input.dTag,
+      aggregateHash: input.aggregateHash,
+      lastResolvedAt: input.lastResolvedAt ?? now2,
+      foregroundTtlMs: input.foregroundTtlMs ?? DEFAULT_FOREGROUND_TTL_MS,
+      backgroundTtlMs: input.backgroundTtlMs ?? DEFAULT_BACKGROUND_TTL_MS
+    };
+    index.updatedAt = now2;
+    await this.writeIndex(cache2, index);
   }
-  return [...out];
-}
-async function getSignerRelayUrls(signerProvider, direction) {
-  const signer = signerProvider?.getSigner();
-  if (!signer?.getRelays) return [];
-  try {
-    const relays = await signer.getRelays();
-    return dedupeRelayUrls(Object.entries(relays).flatMap(([url, permissions]) => {
-      if (direction === "read" && permissions.read) return [url];
-      if (direction === "write" && permissions.write) return [url];
-      return [];
-    }));
-  } catch {
-    return [];
+  async getCoordinate(input, options = {}) {
+    const cache2 = await this.open();
+    const index = await this.readIndex(cache2);
+    const coordinate = index.coordinates[coordinateKey(input.kind, input.pubkey, input.dTag)];
+    if (!coordinate) return void 0;
+    return { ...coordinate, fresh: isCoordinateFresh(coordinate, options) };
   }
-}
-async function getBootstrapRelayUrls(getSimulation, signerProvider, getHostRelayUrls) {
-  return dedupeRelayUrls([
-    ...getHostRelayUrls?.() ?? getPajaRelayUrls(getSimulation()),
-    ...await getSignerRelayUrls(signerProvider, "read")
-  ]);
-}
-function createPajaContactListLoader(backend, getSimulation, signerProvider, getHostRelayUrls) {
-  return async (pubkey2, signal) => {
-    if (!/^[0-9a-fA-F]{64}$/.test(pubkey2) || signal?.aborted) return [];
-    const relayUrls2 = await getBootstrapRelayUrls(getSimulation, signerProvider, getHostRelayUrls);
-    if (signal?.aborted) return [];
-    const filters = [{
-      kinds: [PAJA_CONTACT_LIST_KIND],
-      authors: [pubkey2],
-      limit: PAJA_CONTACT_LIST_CANDIDATE_LIMIT
-    }];
-    const contactQuery = contactListCandidateQueries.get(backend);
-    const candidates = contactQuery ? await contactQuery(relayUrls2, filters, PAJA_LIVE_QUERY_WAIT_MS, signal) : await backend.query(relayUrls2, filters, PAJA_LIVE_QUERY_WAIT_MS);
-    if (signal?.aborted) return [];
-    return candidates.filter((event) => event.kind === PAJA_CONTACT_LIST_KIND && event.pubkey.toLowerCase() === pubkey2.toLowerCase()).sort((left, right) => right.created_at - left.created_at || left.id.localeCompare(right.id)).slice(0, PAJA_CONTACT_LIST_CANDIDATE_LIMIT);
-  };
-}
-function latestEvent(events, kind, pubkey2) {
-  return events.filter((event) => event.kind === kind && event.pubkey === pubkey2).sort((a, b) => b.created_at - a.created_at)[0];
-}
-function createPajaRelayListLoader(backend, getSimulation, signerProvider, getHostRelayUrls) {
-  const registry2 = createNip65Registry();
-  return async (pubkeys) => {
-    const uniquePubkeys = [...new Set(pubkeys.filter((pubkey2) => /^[0-9a-fA-F]{64}$/.test(pubkey2)))];
-    const missing = uniquePubkeys.filter((pubkey2) => !registry2.has(pubkey2));
-    if (missing.length > 0) {
-      const events = await backend.query(await getBootstrapRelayUrls(
-        getSimulation,
-        signerProvider,
-        getHostRelayUrls
-      ), [{
-        kinds: [PAJA_NIP65_RELAY_LIST_KIND],
-        authors: missing,
-        limit: Math.max(missing.length * 2, 10)
-      }], PAJA_LIVE_QUERY_WAIT_MS);
-      for (const pubkey2 of missing) {
-        const event = latestEvent(events, PAJA_NIP65_RELAY_LIST_KIND, pubkey2);
-        if (event) registry2.ingest(event);
-      }
-    }
-    const out = /* @__PURE__ */ new Map();
-    for (const pubkey2 of uniquePubkeys) {
-      const entries = registry2.getRelayList(pubkey2);
-      if (entries) {
-        out.set(pubkey2, {
-          read: selectReadRelays(entries),
-          write: selectWriteRelays(entries)
-        });
-      }
-    }
-    return out;
-  };
-}
-function createPajaOutboxRelayPool(backend) {
-  return {
-    subscribe(filters, relayUrls2, callback) {
-      return backend.subscription(relayUrls2, filters).subscribe((item) => callback(item));
-    },
-    publish(event, relayUrls2) {
-      return backend.publishToRelays(relayUrls2, event);
-    },
-    isAvailable() {
-      return backend.isAvailable();
-    }
-  };
-}
-
-// src/browser-social-cache.ts
-var HEX_PUBKEY = /^[0-9a-f]{64}$/i;
-var FOLLOW_PARSE_YIELD_EVERY = 64;
-var PROFILE_WARM_YIELD_EVERY = 64;
-function createPajaSocialCache(options) {
-  let generation = 0;
-  let activeRefreshController;
-  const snapshots = /* @__PURE__ */ new Map();
-  async function loadFollows(capturedPubkey) {
-    const normalizedPubkey = normalizePubkey(capturedPubkey);
-    if (!normalizedPubkey) return [];
-    const existing = snapshots.get(normalizedPubkey);
-    if (existing) return [...existing.follows];
-    const capturedGeneration = generation;
-    const follows = await verifiedFollows(normalizedPubkey);
-    const warmed = snapshots.get(normalizedPubkey);
-    if (warmed) return [...warmed.follows];
-    if (generation === capturedGeneration) {
-      snapshots.set(normalizedPubkey, { follows, profiles: /* @__PURE__ */ new Map() });
+  async touchAggregate(dTag, aggregateHash, now2 = this.now()) {
+    const cache2 = await this.open();
+    const index = await this.readIndex(cache2);
+    const key = aggregateKey(dTag, aggregateHash);
+    const aggregate = index.aggregates[key];
+    if (!aggregate) return;
+    aggregate.lastAccessed = now2;
+    for (const hash of aggregate.blobHashes) {
+      if (index.blobs[hash]) index.blobs[hash].lastAccessed = now2;
     }
-    return [...follows];
+    index.updatedAt = now2;
+    await this.writeIndex(cache2, index);
   }
-  async function verifiedFollows(capturedPubkey, isStillCurrent, signal) {
-    const candidates = await options.loadContactList(capturedPubkey, signal);
-    const verified = [];
-    for (const candidate of candidates) {
-      if (isStillCurrent && !isStillCurrent()) return [];
-      if (!isContactCandidate(candidate, capturedPubkey)) continue;
-      try {
-        if (await options.verifyEvent(candidate)) verified.push(candidate);
-      } catch {
-      }
-    }
-    return contactPubkeys(selectReplacement(verified), isStillCurrent);
+  markAggregateActive(dTag, aggregateHash) {
+    this.activeAggregates.add(aggregateKey(dTag, aggregateHash));
   }
-  async function refreshActiveIdentity() {
-    activeRefreshController?.abort();
-    activeRefreshController = void 0;
-    const currentGeneration = ++generation;
-    const capturedPubkey = normalizePubkey(options.getActivePubkey() ?? "");
-    if (!capturedPubkey) return;
-    const controller = new AbortController();
-    activeRefreshController = controller;
-    const isStillCurrent = () => !controller.signal.aborted && isCurrent(capturedPubkey, currentGeneration);
+  releaseAggregateActive(dTag, aggregateHash) {
+    this.activeAggregates.delete(aggregateKey(dTag, aggregateHash));
+  }
+  async prune(now2 = this.now()) {
     try {
-      const follows = await verifiedFollows(capturedPubkey, isStillCurrent, controller.signal);
-      if (!isStillCurrent()) return;
-      const snapshot = { follows, profiles: /* @__PURE__ */ new Map() };
-      snapshots.set(capturedPubkey, snapshot);
-      for (let index = 0; index < follows.length; index += 1) {
-        if (!isStillCurrent()) return;
-        const author = follows[index];
-        let warmed;
-        try {
-          warmed = await options.baseRouter.query(
-            [{ kinds: [0], authors: [author], limit: 1 }],
-            { authors: [author], limit: 1 }
-          );
-        } catch {
-        }
-        if (!isStillCurrent()) return;
-        if (warmed) {
-          const profile = profileResult(warmed, author);
-          if (profile) snapshot.profiles.set(author, profile);
+      const cache2 = await this.open();
+      const index = await this.readIndex(cache2);
+      let size = cachedSize(index);
+      const budget = await this.budgetBytes();
+      const hardBudget = await this.hardBudgetBytes();
+      const shouldPrune = size > budget || await this.originPressureHigh();
+      if (!shouldPrune) return;
+      this.rewriteRefCounts(index);
+      for (const [hash, blob] of Object.entries(index.blobs)) {
+        if (size <= budget) break;
+        if (blob.refCount > 0) continue;
+        await cache2.delete(this.blobUrl(hash));
+        delete index.blobs[hash];
+        size -= blob.size;
+      }
+      const currentAggregateHashes = new Set(
+        Object.values(index.coordinates).map((coordinate) => coordinate.aggregateHash)
+      );
+      const aggregates = Object.values(index.aggregates).filter((entry) => !this.activeAggregates.has(entry.key)).sort((a, b) => {
+        const currentA = currentAggregateHashes.has(a.aggregateHash) ? 1 : 0;
+        const currentB = currentAggregateHashes.has(b.aggregateHash) ? 1 : 0;
+        if (currentA !== currentB) return currentA - currentB;
+        return a.lastAccessed - b.lastAccessed;
+      });
+      for (const aggregate of aggregates) {
+        if (size <= budget) break;
+        await cache2.delete(this.aggregateUrl(aggregate.key));
+        delete index.aggregates[aggregate.key];
+        size -= aggregate.size;
+        this.rewriteRefCounts(index);
+      }
+      if (size > hardBudget) {
+        const active = Object.values(index.aggregates).filter((entry) => this.activeAggregates.has(entry.key)).sort((a, b) => a.lastAccessed - b.lastAccessed);
+        for (const aggregate of active) {
+          if (size <= hardBudget) break;
+          await cache2.delete(this.aggregateUrl(aggregate.key));
+          delete index.aggregates[aggregate.key];
+          size -= aggregate.size;
         }
-        if ((index + 1) % PROFILE_WARM_YIELD_EVERY === 0 && index + 1 < follows.length) {
-          if (!isStillCurrent()) return;
-          await yieldToEventLoop();
-          if (!isStillCurrent()) return;
+      }
+      this.rewriteRefCounts(index);
+      for (const [hash, blob] of Object.entries(index.blobs)) {
+        if (blob.refCount === 0) {
+          await cache2.delete(this.blobUrl(hash));
+          delete index.blobs[hash];
         }
       }
-    } catch {
-    } finally {
-      if (activeRefreshController === controller) activeRefreshController = void 0;
+      index.updatedAt = now2;
+      await this.writeIndex(cache2, index);
+    } catch (cause) {
+      this.diagnostic({ type: "cache-prune-failed", message: "failed to prune napplet artifact cache", cause });
     }
   }
-  function isCurrent(capturedPubkey, currentGeneration) {
-    return generation === currentGeneration && normalizePubkey(options.getActivePubkey() ?? "") === capturedPubkey;
-  }
-  function decorate(router, canReadIdentity) {
-    return {
-      ...router.getEvent ? { getEvent: router.getEvent.bind(router) } : {},
-      async query(filters, queryOptions) {
-        const canAugmentAtStart = canReadIdentity?.() ?? true;
-        const activePubkey = normalizePubkey(options.getActivePubkey() ?? "");
-        const snapshot = canAugmentAtStart && activePubkey ? snapshots.get(activePubkey) : void 0;
-        const base = await router.query(filters, queryOptions);
-        if (!canAugmentAtStart || !(canReadIdentity?.() ?? true)) return base;
-        const cached = matchingCachedProfiles(snapshot?.profiles, filters);
-        return mergeResult(base, cached, filters, queryOptions);
-      },
-      subscribe: router.subscribe.bind(router),
-      publish: router.publish.bind(router),
-      resolveRelays: router.resolveRelays.bind(router)
-    };
+  async snapshotIndex() {
+    return this.readIndex(await this.open());
   }
-  const unsubscribe = options.subscribeSignerChange?.(() => {
-    void refreshActiveIdentity();
-  });
-  return {
-    getFollows: loadFollows,
-    refreshActiveIdentity,
-    decorate,
-    dispose: () => {
-      activeRefreshController?.abort();
-      unsubscribe?.();
-    }
-  };
-}
-function normalizePubkey(value) {
-  return typeof value === "string" && HEX_PUBKEY.test(value) ? value.toLowerCase() : null;
-}
-function isContactCandidate(candidate, capturedPubkey) {
-  if (typeof candidate !== "object" || candidate === null) return false;
-  const event = candidate;
-  return event.kind === 3 && normalizePubkey(event.pubkey) === capturedPubkey;
-}
-function selectReplacement(events) {
-  return [...events].sort((left, right) => {
-    const timestampOrder = right.created_at - left.created_at;
-    if (timestampOrder !== 0) return timestampOrder;
-    if (left.id === right.id) return 0;
-    return left.id < right.id ? -1 : 1;
-  })[0];
-}
-async function contactPubkeys(event, isStillCurrent) {
-  if (!event || !Array.isArray(event.tags)) return [];
-  const follows = /* @__PURE__ */ new Set();
-  for (let index = 0; index < event.tags.length; index += 1) {
-    if (isStillCurrent && !isStillCurrent()) return [];
-    const tag = event.tags[index];
-    if (Array.isArray(tag) && tag[0] === "p") {
-      const pubkey2 = normalizePubkey(tag[1]);
-      if (pubkey2) follows.add(pubkey2);
+  async writeVerifiedResolutionOnce(input) {
+    const cache2 = await this.open();
+    const now2 = input.now ?? this.now();
+    const index = await this.readIndex(cache2);
+    const blobHashes = [];
+    for (const pathEntry of input.manifest.paths) {
+      const bytes = input.files.get(pathEntry.path);
+      if (!bytes) continue;
+      blobHashes.push(pathEntry.sha256);
+      await cache2.put(this.blobUrl(pathEntry.sha256), new Response(responseBody(bytes)));
+      index.blobs[pathEntry.sha256] = {
+        size: byteLength2(bytes),
+        lastAccessed: now2,
+        refCount: index.blobs[pathEntry.sha256]?.refCount ?? 0
+      };
     }
-    if ((index + 1) % FOLLOW_PARSE_YIELD_EVERY === 0 && index + 1 < event.tags.length) {
-      await yieldToEventLoop();
-      if (isStillCurrent && !isStillCurrent()) return [];
+    const key = aggregateKey(input.manifest.dTag, input.manifest.aggregateHash);
+    const record = {
+      schemaVersion: SCHEMA_VERSION,
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      manifest: {
+        kind: input.manifest.kind,
+        pubkey: input.manifest.pubkey,
+        dTag: input.manifest.dTag,
+        paths: input.manifest.paths.map((entry) => ({ path: entry.path, sha256: entry.sha256 })),
+        requires: [...input.manifest.requires],
+        ...input.manifest.title === void 0 ? {} : { title: input.manifest.title },
+        ...input.manifest.description === void 0 ? {} : { description: input.manifest.description }
+      },
+      indexHtml: input.indexHtml,
+      blobHashes,
+      writtenAt: now2
+    };
+    const aggregateBytes = new TextEncoder().encode(JSON.stringify(record));
+    await cache2.put(this.aggregateUrl(key), new Response(responseBody(aggregateBytes), {
+      headers: { "content-type": "application/json" }
+    }));
+    const coordKey = coordinateKey(input.manifest.kind, input.manifest.pubkey, input.manifest.dTag);
+    index.aggregates[key] = {
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      key,
+      blobHashes,
+      size: byteLength2(aggregateBytes),
+      lastAccessed: now2,
+      coordinateKey: coordKey
+    };
+    index.coordinates[coordKey] = {
+      key: coordKey,
+      kind: input.manifest.kind,
+      pubkey: input.manifest.pubkey,
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      lastResolvedAt: now2,
+      foregroundTtlMs: DEFAULT_FOREGROUND_TTL_MS,
+      backgroundTtlMs: DEFAULT_BACKGROUND_TTL_MS
+    };
+    this.rewriteRefCounts(index);
+    index.updatedAt = now2;
+    await this.writeIndex(cache2, index);
+    await this.prune(now2);
+  }
+  async open() {
+    this.cachePromise ??= this.cacheStorage.open(this.cacheName);
+    return this.cachePromise;
+  }
+  indexUrl() {
+    return new URL("__kehto_napplet_cache/index.json", this.baseUrl).toString();
+  }
+  blobUrl(hash) {
+    return new URL(`__kehto_napplet_cache/blob/${encodeKeyPart(hash)}`, this.baseUrl).toString();
+  }
+  aggregateUrl(key) {
+    return new URL(`__kehto_napplet_cache/aggregate/${encodeKeyPart(key)}.json`, this.baseUrl).toString();
+  }
+  async readIndex(cache2) {
+    const response = await cache2.match(this.indexUrl());
+    if (!response) return emptyIndex(this.now());
+    try {
+      const index = await responseJson(response);
+      if (index.schemaVersion !== SCHEMA_VERSION) return emptyIndex(this.now());
+      return index;
+    } catch {
+      return emptyIndex(this.now());
     }
   }
-  return [...follows];
-}
-function profileResult(result2, author) {
-  let newest;
-  for (const entry of result2.events) {
-    if (entry.event.kind !== 0 || normalizePubkey(entry.event.pubkey) !== author) continue;
-    if (!newest || isNewerProfile(entry, newest)) newest = entry;
+  async writeIndex(cache2, index) {
+    await cache2.put(this.indexUrl(), new Response(JSON.stringify(index), {
+      headers: { "content-type": "application/json" }
+    }));
   }
-  return newest;
-}
-function isNewerProfile(candidate, existing) {
-  if (candidate.event.created_at !== existing.event.created_at) {
-    return candidate.event.created_at > existing.event.created_at;
+  rewriteRefCounts(index) {
+    const counts = refCounts(index);
+    for (const [hash, blob] of Object.entries(index.blobs)) {
+      blob.refCount = counts[hash] ?? 0;
+    }
   }
-  return candidate.event.id < existing.event.id;
-}
-function yieldToEventLoop() {
-  return new Promise((resolve) => setTimeout(resolve, 0));
-}
-function matchingCachedProfiles(profiles, filters) {
-  const readyProfiles = profiles ? [...profiles.values()] : [];
-  if (filters.length === 0) return readyProfiles;
-  const matched = /* @__PURE__ */ new Map();
-  for (const filter of filters) {
-    const limit = typeof filter.limit === "number" && filter.limit >= 0 ? filter.limit : void 0;
-    let count = 0;
-    for (const entry of readyProfiles) {
-      if (!matchesAnyFilter2(entry.event, [filter])) continue;
-      if (limit !== void 0 && count >= limit) continue;
-      count += 1;
-      if (!matched.has(entry.event.id)) matched.set(entry.event.id, entry);
+  async budgetBytes() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota) return this.unknownBudgetBytes;
+    return Math.min(this.softCeilingBytes, Math.floor(estimate.quota * 0.1));
+  }
+  async hardBudgetBytes() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota) return this.unknownBudgetBytes;
+    return Math.min(this.hardCeilingBytes, Math.floor(estimate.quota * 0.2));
+  }
+  async originPressureHigh() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota || estimate.usage === void 0) return false;
+    return estimate.usage / estimate.quota >= 0.8;
+  }
+  async estimateStorage() {
+    if (!this.storage?.estimate) return void 0;
+    try {
+      return this.storage.estimate();
+    } catch (cause) {
+      this.diagnostic({
+        type: "storage-estimate-unavailable",
+        message: "storage estimate failed; using unknown quota cache budget",
+        cause
+      });
+      return void 0;
     }
   }
-  return [...matched.values()];
-}
-function mergeResult(base, cached, filters, queryOptions) {
-  const events = /* @__PURE__ */ new Map();
-  for (const entry of base.events) events.set(entry.event.id, entry);
-  for (const entry of cached) {
-    if (!events.has(entry.event.id)) events.set(entry.event.id, entry);
+  diagnostic(diagnostic) {
+    this.onDiagnostic?.(diagnostic);
   }
-  return {
-    events: applyFinalLimits([...events.values()], filters, queryOptions),
-    ...base.incomplete === void 0 ? {} : { incomplete: base.incomplete },
-    ...base.error === void 0 ? {} : { error: base.error }
-  };
-}
-function applyFinalLimits(entries, filters, queryOptions) {
-  const aggregateLimit = typeof queryOptions?.limit === "number" && queryOptions.limit >= 0 ? queryOptions.limit : void 0;
-  const aggregateCapped = aggregateLimit === void 0 ? entries : entries.slice(0, aggregateLimit);
-  if (filters.length === 0) return aggregateCapped;
-  const counts = filters.map(() => 0);
-  return aggregateCapped.filter((entry) => {
-    const matching = filters.flatMap((filter, index) => matchesAnyFilter2(entry.event, [filter]) ? [index] : []);
-    const allowed2 = matching.some((index) => {
-      const limit = filters[index]?.limit;
-      return typeof limit !== "number" || limit < 0 || counts[index] < limit;
+};
+async function openNappletArtifactCache(options = {}) {
+  const cacheStorage = options.cacheStorage ?? globalThis.caches;
+  if (!cacheStorage) return void 0;
+  const storage = options.storage ?? globalThis.navigator?.storage;
+  if (options.requireStorageEstimate && !storage?.estimate) {
+    options.onDiagnostic?.({
+      type: "storage-estimate-unavailable",
+      message: "storage estimates are unavailable; using network-only loading"
     });
-    if (!allowed2) return false;
-    for (const index of matching) counts[index] += 1;
-    return true;
-  });
-}
-
-// src/browser-relay-policy.ts
-var PAJA_STORAGE_PROBE_KEY = "kehto:paja:storage-probe";
-function normalizeRelayUrl(value) {
+    return void 0;
+  }
   try {
-    const url = new URL(value);
-    if (url.protocol !== "wss:" && url.protocol !== "ws:" || url.username || url.password) return null;
-    url.hash = "";
-    return url.href;
-  } catch {
-    return null;
+    const cache2 = new CacheStorageNappletArtifactCache({ ...options, cacheStorage, storage });
+    await cache2.snapshotIndex();
+    return cache2;
+  } catch (cause) {
+    options.onDiagnostic?.({
+      type: "cache-open-failed",
+      message: "Cache Storage napplet artifact cache could not be opened",
+      cause
+    });
+    return void 0;
   }
 }
-function isVerifiedNostrEvent(value) {
-  if (typeof value !== "object" || value === null) return false;
-  try {
-    return verifyEvent(value);
-  } catch {
-    return false;
+var NAPPLET_KIND_SNAPSHOT = 5129;
+var NAPPLET_KIND_ROOT = 15129;
+var NAPPLET_KIND_NAMED = 35129;
+var NAPPLET_KINDS = [
+  NAPPLET_KIND_SNAPSHOT,
+  NAPPLET_KIND_ROOT,
+  NAPPLET_KIND_NAMED
+];
+function isNappletManifestKind(kind) {
+  return NAPPLET_KINDS.includes(kind);
+}
+var NappletResolutionError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "NappletResolutionError";
+    this.code = code;
+  }
+};
+function firstTagValue(tags, name) {
+  for (const tag of tags) {
+    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) return tag[1];
   }
+  return void 0;
 }
-function isPajaRelayAllowed(value, getConfiguredRelays) {
-  const normalized = normalizeRelayUrl(value);
-  if (!normalized) return false;
-  if (getConfiguredRelays().some((url2) => normalizeRelayUrl(url2) === normalized)) return true;
-  const url = new URL(normalized);
-  if (url.protocol !== "wss:") return false;
-  const hostname = url.hostname.replace(/^\[|\]$/gu, "").toLowerCase();
-  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || !hostname.includes(".")) return false;
-  if (hostname.includes(":")) {
-    return hostname !== "::" && hostname !== "::1" && !/^(?:fc|fd|fe[89ab])/iu.test(hostname);
+function allTagValues(tags, name) {
+  const out = [];
+  for (const tag of tags) {
+    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) out.push(tag[1]);
   }
-  const octets = hostname.split(".").map(Number);
-  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return true;
-  const [first, second] = octets;
-  return first !== 0 && first !== 10 && first !== 127 && first < 224 && !(first === 100 && second >= 64 && second <= 127) && !(first === 169 && second === 254) && !(first === 172 && second >= 16 && second <= 31) && !(first === 192 && second === 168) && !(first === 198 && (second === 18 || second === 19));
+  return out;
 }
-function createPajaRelayConfig(getSimulation) {
-  const tierNames = ["discovery", "super", "outbox"];
-  const additions = /* @__PURE__ */ new Map();
-  const removals = /* @__PURE__ */ new Map();
-  const current = { discovery: [], super: [], outbox: [] };
-  const allRelays = [];
-  function isTier(value) {
-    return tierNames.includes(value);
-  }
-  function refresh() {
-    for (const tier of tierNames) {
-      const seen = /* @__PURE__ */ new Set();
-      const values = [];
-      const removed = removals.get(tier);
-      for (const url of [...getPajaRelayUrls(getSimulation()), ...additions.get(tier)?.values() ?? []]) {
-        const normalized = normalizeRelayUrl(url);
-        if (!normalized || seen.has(normalized) || removed?.has(normalized)) continue;
-        seen.add(normalized);
-        values.push(url);
-      }
-      current[tier].splice(0, current[tier].length, ...values);
+function archetypesFromTags(tags) {
+  const out = [];
+  for (const tag of tags) {
+    if (tag[0] !== "archetype") continue;
+    const slug = tag[1];
+    if (typeof slug !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
+      throw new NappletResolutionError(
+        "invalid-manifest",
+        "archetype slug must contain lowercase letters, numbers, and hyphens"
+      );
     }
-    const combined = [...new Set(tierNames.flatMap((tier) => current[tier]))];
-    allRelays.splice(0, allRelays.length, ...combined);
-  }
-  const runtime = {
-    allRelays,
-    outboxRelays: current.outbox,
-    addRelay(tier, url) {
-      const normalized = normalizeRelayUrl(url);
-      if (!isTier(tier) || !normalized) return;
-      const entries = additions.get(tier) ?? /* @__PURE__ */ new Map();
-      entries.set(normalized, url);
-      additions.set(tier, entries);
-      removals.get(tier)?.delete(normalized);
-      refresh();
-    },
-    removeRelay(tier, url) {
-      const normalized = normalizeRelayUrl(url);
-      if (!isTier(tier) || !normalized) return;
-      additions.get(tier)?.delete(normalized);
-      const entries = removals.get(tier) ?? /* @__PURE__ */ new Set();
-      entries.add(normalized);
-      removals.set(tier, entries);
-      refresh();
-    },
-    getRelayConfig() {
-      refresh();
-      return {
-        discovery: [...current.discovery],
-        super: [...current.super],
-        outbox: [...current.outbox]
-      };
-    },
-    getNip66Suggestions: () => [],
-    getRelayUrls(tiers = tierNames) {
-      refresh();
-      return [...new Set(tiers.flatMap((tier) => current[tier]))];
+    const convention = tag[2];
+    if (typeof convention !== "string" || convention.length === 0) {
+      throw new NappletResolutionError("invalid-manifest", "archetype convention is required");
     }
-  };
-  refresh();
-  return runtime;
+    if (/^NAP-\d+$/.test(convention)) {
+      throw new NappletResolutionError(
+        "invalid-manifest",
+        "numbered NAP identifier is not an archetype convention"
+      );
+    }
+    if (!/^napplet:[^/?#\s]+\/[^/?#\s]+$/.test(convention)) {
+      throw new NappletResolutionError(
+        "invalid-manifest",
+        "archetype convention must be a queryless napplet:<archetype>/<intent> identity"
+      );
+    }
+    if (tag.length !== 3) {
+      throw new NappletResolutionError(
+        "invalid-manifest",
+        "archetype tags must contain exactly slug and convention"
+      );
+    }
+    out.push({ slug, convention });
+  }
+  return out;
 }
-function createPajaRelayHooks(pool, getSimulation, relayConfig) {
-  const cleanups = /* @__PURE__ */ new Map();
-  const scoped = /* @__PURE__ */ new Map();
-  function closeScopedRelay(windowId) {
-    scoped.get(windowId)?.unsubscribe();
-    scoped.delete(windowId);
+function parseNappletManifest(event) {
+  if (!isNappletManifestKind(event.kind)) {
+    throw new NappletResolutionError("invalid-manifest", `not a NIP-5D napplet kind: ${event.kind}`);
+  }
+  const paths = pathEntriesFromTags(event.tags);
+  if (paths.length === 0) {
+    throw new NappletResolutionError("invalid-manifest", "manifest has no path tags");
+  }
+  const aggregateHash = aggregateTagValue(event.tags);
+  if (!aggregateHash) {
+    throw new NappletResolutionError("invalid-manifest", "manifest has no aggregate x tag");
+  }
+  const dTag = firstTagValue(event.tags, "d");
+  if (event.kind !== NAPPLET_KIND_NAMED && dTag !== void 0) {
+    throw new NappletResolutionError("invalid-manifest", "only named manifests may carry a d tag");
   }
   return {
-    getRelayPool: () => pool,
-    trackSubscription(subKey, cleanup) {
-      cleanups.set(subKey, cleanup);
-    },
-    untrackSubscription(subKey) {
-      cleanups.get(subKey)?.();
-      cleanups.delete(subKey);
-    },
-    openScopedRelay(windowId, relayUrl2, subId, filters, sourceWindow) {
-      closeScopedRelay(windowId);
-      const configured = new Map(relayConfig.getRelayUrls().flatMap((url) => {
-        const normalized = normalizeRelayUrl(url);
-        return normalized ? [[normalized, url]] : [];
-      }));
-      const requested = normalizeRelayUrl(relayUrl2);
-      const allowedUrl = requested && isPajaRelayAllowed(relayUrl2, () => relayConfig.getRelayUrls()) ? configured.get(requested) ?? requested : void 0;
-      if (getSimulation().relay.mode !== "live" || !allowedUrl) {
-        sourceWindow.postMessage({ type: "relay.closed", subId, reason: "scoped relay unavailable" }, "*");
-        return;
-      }
-      const subscription = pool.subscription([allowedUrl], filters).subscribe((item) => {
-        if (item === "EOSE") {
-          sourceWindow.postMessage({ type: "relay.eose", subId }, "*");
-          return;
-        }
-        if (!isVerifiedNostrEvent(item)) return;
-        sourceWindow.postMessage({
-          type: "relay.event",
-          subId,
-          result: { event: item, sidecar: { relayHints: [allowedUrl] } }
-        }, "*");
-      });
-      scoped.set(windowId, { relayUrl: allowedUrl, unsubscribe: () => subscription.unsubscribe() });
-    },
-    closeScopedRelay,
-    publishToScopedRelay: async (windowId, event) => {
-      const active = scoped.get(windowId);
-      if (getSimulation().relay.mode !== "live" || !active || !verifyEvent(event)) return false;
-      try {
-        await pool.publish([active.relayUrl], event);
-        return true;
-      } catch {
-        return false;
-      }
-    },
-    selectRelayTier: () => relayConfig.getRelayUrls(["discovery", "super"])
+    kind: event.kind,
+    pubkey: event.pubkey,
+    dTag: dTag ?? "",
+    paths,
+    aggregateHash,
+    servers: allTagValues(event.tags, "server"),
+    requires: allTagValues(event.tags, "requires"),
+    archetypes: archetypesFromTags(event.tags),
+    title: firstTagValue(event.tags, "title"),
+    description: firstTagValue(event.tags, "description"),
+    source: firstTagValue(event.tags, "source")
   };
 }
-function hasWritableLocalStorage() {
-  if (typeof localStorage === "undefined") return false;
-  let previous = null;
+function verifyManifestSignature(event) {
   try {
-    previous = localStorage.getItem(PAJA_STORAGE_PROBE_KEY);
-    localStorage.setItem(PAJA_STORAGE_PROBE_KEY, "1");
-    const available = localStorage.getItem(PAJA_STORAGE_PROBE_KEY) === "1";
-    if (previous === null) localStorage.removeItem(PAJA_STORAGE_PROBE_KEY);
-    else localStorage.setItem(PAJA_STORAGE_PROBE_KEY, previous);
-    return available;
+    return verifyEvent(event);
   } catch {
-    try {
-      if (previous === null) localStorage.removeItem(PAJA_STORAGE_PROBE_KEY);
-      else localStorage.setItem(PAJA_STORAGE_PROBE_KEY, previous);
-    } catch {
-    }
     return false;
   }
 }
-
-// src/browser-common.ts
-var HEX_64 = /^[0-9a-f]{64}$/i;
-var SHORTCODE = /^:[a-zA-Z0-9_+-]+:$/;
-function relayUrls(values) {
-  const urls = /* @__PURE__ */ new Set();
-  for (const value of values) {
+function verifyBlobHash(bytes, sha256Hex) {
+  return bytesToHex2(sha256(bytes)) === sha256Hex;
+}
+function stripTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+async function fetchBlob(servers, sha256Hex, fetchBytes) {
+  for (const server of servers) {
+    const url = `${stripTrailingSlash(server)}/${sha256Hex}`;
     try {
-      const url = new URL(value);
-      if (url.protocol === "wss:" || url.protocol === "ws:") urls.add(url.href);
+      const bytes = await fetchBytes(url);
+      if (verifyBlobHash(bytes, sha256Hex)) return bytes;
     } catch {
     }
   }
-  return [...urls];
+  throw new NappletResolutionError("blob-unavailable", `no server served blob ${sha256Hex}`);
 }
-function profileTarget(target, defaults) {
-  if (HEX_64.test(target)) return { pubkey: target.toLowerCase(), relays: relayUrls(defaults) };
-  try {
-    const decoded = decode(target);
-    if (decoded.type === "npub") {
-      return { pubkey: decoded.data.toLowerCase(), relays: relayUrls(defaults) };
-    }
-    if (decoded.type === "nprofile") {
-      return {
-        pubkey: decoded.data.pubkey.toLowerCase(),
-        relays: relayUrls([
-          ...(decoded.data.relays ?? []).filter((relay) => isPajaRelayAllowed(relay, () => defaults)),
-          ...defaults
-        ])
-      };
-    }
-  } catch {
-    return null;
-  }
-  return null;
+var INDEX_PATHS = ["/index.html", "index.html", "/"];
+function defaultDecode(bytes) {
+  return new TextDecoder().decode(bytes);
 }
-function npub(value) {
-  try {
-    const decoded = decode(value);
-    return decoded.type === "npub" ? decoded.data.toLowerCase() : null;
-  } catch {
-    return null;
+async function resolveNapplet(options) {
+  const { event, fetchBlob: fetchBlobBytes, textDecode = defaultDecode, cache: cache2 } = options;
+  if (!verifyManifestSignature(event)) {
+    throw new NappletResolutionError("invalid-signature", "manifest signature is invalid");
+  }
+  const manifest = parseNappletManifest(event);
+  const recomputed = computeAggregateHash(manifest.paths);
+  if (recomputed !== manifest.aggregateHash) {
+    throw new NappletResolutionError(
+      "aggregate-mismatch",
+      `recomputed aggregate ${recomputed} != manifest ${manifest.aggregateHash}`
+    );
+  }
+  const files = /* @__PURE__ */ new Map();
+  for (const entry of manifest.paths) {
+    let bytes = await cache2?.readBlob(entry.sha256);
+    if (bytes && !verifyBlobHash(bytes, entry.sha256)) {
+      await cache2?.deleteBlob(entry.sha256);
+      bytes = void 0;
+    }
+    bytes ??= await fetchBlobBytes(entry.sha256, manifest.servers);
+    if (!verifyBlobHash(bytes, entry.sha256)) {
+      throw new NappletResolutionError(
+        "blob-hash-mismatch",
+        `blob for ${entry.path} does not match hash ${entry.sha256}`
+      );
+    }
+    files.set(entry.path, bytes);
+  }
+  const indexEntry = manifest.paths.find((e) => INDEX_PATHS.includes(e.path));
+  if (!indexEntry) {
+    throw new NappletResolutionError("missing-index", "manifest has no /index.html entry");
   }
+  const indexHtml = textDecode(files.get(indexEntry.path));
+  await cache2?.writeVerifiedResolution({ event, manifest, files, indexHtml });
+  return {
+    dTag: manifest.dTag,
+    aggregateHash: manifest.aggregateHash,
+    files,
+    indexHtml,
+    manifest
+  };
 }
-function pubkey(value) {
-  if (HEX_64.test(value)) return value.toLowerCase();
-  return npub(value);
+
+// src/browser-resource.ts
+var PAJA_RESOURCE_MAX_BYTES = 10 * 1024 * 1024;
+var PAJA_RESOURCE_MAX_URLS = 100;
+var PAJA_RESOURCE_MAX_SERVERS = 8;
+var UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
+var BLOSSOM_RESOURCE_PATTERN = /^blossom:sha256:([0-9a-f]{64})$/i;
+function createPajaResourceFetch(options = {}) {
+  return async (value, init) => {
+    if (init.signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
+    const url = new URL(value);
+    if (init.method && init.method.toUpperCase() !== "GET") {
+      throw new ResourceServiceError("invalid-request", "NAP-RESOURCE is read-only");
+    }
+    if (url.protocol === "blossom:") {
+      return fetchBlossomResource(
+        value,
+        init.signal,
+        init.servers ?? [],
+        init.windowId,
+        options
+      );
+    }
+    if (url.protocol === "http:" || url.protocol === "https:") {
+      return fetchNetworkResource(value, init.signal, options.fetch ?? globalThis.fetch);
+    }
+    if (url.protocol !== "data:") {
+      throw new ResourceServiceError("unsupported-scheme", `Paja does not enable ${url.protocol}`);
+    }
+    if (value.length > encodedDataUrlLimit(PAJA_RESOURCE_MAX_BYTES)) {
+      throw new ResourceServiceError("too-large", `resource exceeds ${PAJA_RESOURCE_MAX_BYTES} bytes`);
+    }
+    const decoded = await fetch(value, { signal: init.signal });
+    const bytes = new Uint8Array(await decoded.arrayBuffer());
+    if (bytes.byteLength > PAJA_RESOURCE_MAX_BYTES) {
+      throw new ResourceServiceError("too-large", `resource exceeds ${PAJA_RESOURCE_MAX_BYTES} bytes`);
+    }
+    const mime = sniffSafeResourceMime(bytes);
+    if (!mime) {
+      throw new ResourceServiceError("decode-failed", "resource bytes are not an enabled safe media type");
+    }
+    return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
+  };
 }
-function newestVerified(events, predicate) {
-  return events.filter((event) => predicate(event) && verifyEvent(event)).sort((left, right) => right.created_at - left.created_at || left.id.localeCompare(right.id))[0] ?? null;
+function pajaResourceInfo() {
+  const schemes = [
+    { scheme: "data", enabled: true },
+    { scheme: "https", enabled: true },
+    { scheme: "http", enabled: true },
+    { scheme: "blossom", enabled: true }
+  ];
+  return {
+    schemes,
+    maxBytes: PAJA_RESOURCE_MAX_BYTES,
+    maxUrls: PAJA_RESOURCE_MAX_URLS,
+    maxServers: PAJA_RESOURCE_MAX_SERVERS
+  };
 }
-function parseProfile(event) {
+async function fetchNetworkResource(value, signal, fetcher) {
+  let response;
   try {
-    const parsed = JSON.parse(event.content);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
-    const profile = { ...parsed };
-    if (typeof profile.display_name === "string" && typeof profile.displayName !== "string") {
-      profile.displayName = profile.display_name;
-    }
-    return profile;
-  } catch {
-    return null;
+    response = await fetcher(value, {
+      method: "GET",
+      signal,
+      credentials: "omit",
+      referrerPolicy: "no-referrer"
+    });
+  } catch (error) {
+    if (signal.aborted || isAbortError(error)) throw error;
+    throw new ResourceServiceError(
+      "network-error",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+  if (response.status === 404 || response.status === 410) {
+    throw new ResourceServiceError("not-found", "HTTP resource was not found");
+  }
+  if (!response.ok) {
+    throw new ResourceServiceError("network-error", `HTTP resource returned ${response.status}`);
+  }
+  const bytes = await readCappedResponse(response, signal);
+  const mime = sniffSafeResourceMime(bytes);
+  if (!mime) {
+    throw new ResourceServiceError("decode-failed", "resource bytes are not an enabled safe media type");
   }
+  return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
 }
-function contactPubkeys2(event) {
-  const follows = /* @__PURE__ */ new Set();
-  for (const tag of event?.tags ?? []) {
-    if (tag[0] === "p" && typeof tag[1] === "string" && HEX_64.test(tag[1])) {
-      follows.add(tag[1].toLowerCase());
+async function fetchBlossomResource(value, signal, requestServers, windowId, options) {
+  const match = BLOSSOM_RESOURCE_PATTERN.exec(value);
+  if (!match?.[1]) {
+    throw new ResourceServiceError("invalid-request", "expected blossom:sha256:<64 hex characters>");
+  }
+  const expectedHash = match[1].toLowerCase();
+  const configuredServers = await options.getBlossomServers?.({ url: value, windowId }) ?? [];
+  if (signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
+  const servers = resolveBlossomServers(requestServers, configuredServers);
+  if (servers.length === 0) {
+    throw new ResourceServiceError("blocked-by-policy", "Paja has no accepted Blossom server");
+  }
+  const fetcher = options.fetch ?? globalThis.fetch;
+  let foundHashMismatch = false;
+  let foundNotFound = false;
+  let foundInconclusive = false;
+  let lastNetworkMessage = "all accepted Blossom servers failed";
+  for (const server of servers) {
+    if (signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
+    const resourceUrl = `${server}/${expectedHash}`;
+    let response;
+    try {
+      response = await fetcher(resourceUrl, {
+        method: "GET",
+        signal,
+        redirect: "error",
+        cache: "no-store",
+        credentials: "omit",
+        referrerPolicy: "no-referrer"
+      });
+    } catch (error) {
+      if (signal.aborted || isAbortError(error)) throw error;
+      foundInconclusive = true;
+      lastNetworkMessage = error instanceof Error ? error.message : String(error);
+      continue;
+    }
+    if (response.status === 404 || response.status === 410) {
+      foundNotFound = true;
+      continue;
+    }
+    if (!response.ok) {
+      foundInconclusive = true;
+      lastNetworkMessage = `Blossom server returned HTTP ${response.status}`;
+      continue;
+    }
+    const bytes = await readCappedResponse(response, signal);
+    if (!verifyBlobHash(bytes, expectedHash)) {
+      foundHashMismatch = true;
+      continue;
     }
+    const mime = sniffSafeResourceMime(bytes);
+    if (!mime) {
+      throw new ResourceServiceError("decode-failed", "resource bytes are not an enabled safe media type");
+    }
+    return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
   }
-  return [...follows];
+  if (foundHashMismatch) {
+    throw new ResourceServiceError("decode-failed", "Blossom response did not match the requested SHA-256");
+  }
+  if (foundInconclusive) {
+    throw new ResourceServiceError("network-error", lastNetworkMessage);
+  }
+  if (foundNotFound) {
+    throw new ResourceServiceError("not-found", "Blossom resource was not found");
+  }
+  throw new ResourceServiceError("network-error", lastNetworkMessage);
 }
-function actionError(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  if (message.includes("denied")) return { ok: false, error: "user-denied" };
-  if (message.includes("publish")) return { ok: false, error: "publish-failed" };
-  return { ok: false, error: message };
+function resolveBlossomServers(requestServers, configuredServers) {
+  const servers = [];
+  for (const value of requestServers) {
+    const server = normalizePublicBlossomServer(value);
+    if (server && !servers.includes(server)) servers.push(server);
+    if (servers.length === PAJA_RESOURCE_MAX_SERVERS) return servers;
+  }
+  for (const server of usableBlossomServers(configuredServers)) {
+    if (!servers.includes(server)) servers.push(server);
+    if (servers.length === PAJA_RESOURCE_MAX_SERVERS) break;
+  }
+  return servers;
 }
-function isSingleEmoji(value) {
-  const graphemes = [...new Intl.Segmenter(void 0, { granularity: "grapheme" }).segment(value)];
-  return graphemes.length === 1 && /[\p{Extended_Pictographic}\p{Regional_Indicator}]/u.test(value);
+function normalizePublicBlossomServer(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return null;
+  try {
+    const url = new URL(value.trim());
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" || !isPublicHostname(url.hostname)) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
 }
-function reactionTags(target, reaction, customEmojiHref) {
-  if (reaction !== "+" && reaction !== "-" && !isSingleEmoji(reaction) && !SHORTCODE.test(reaction)) return null;
-  if (customEmojiHref && !SHORTCODE.test(reaction)) return null;
-  if (SHORTCODE.test(reaction) && !customEmojiHref) return null;
-  const tags = [["e", target.id], ["p", target.pubkey], ["k", String(target.kind)]];
-  if (customEmojiHref) {
-    let url;
+function isPublicHostname(value) {
+  const hostname = value.replace(/^\[|\]$/gu, "").toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || !hostname.includes(".")) return false;
+  if (hostname.includes(":")) {
+    return hostname !== "::" && hostname !== "::1" && !hostname.startsWith("::ffff:") && !/^(?:fc|fd|fe[89ab]|ff)/iu.test(hostname) && !hostname.startsWith("2001:db8:");
+  }
+  const octets = hostname.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return true;
+  const [first, second] = octets;
+  return first !== 0 && first !== 10 && first !== 127 && first < 224 && !(first === 100 && second >= 64 && second <= 127) && !(first === 169 && second === 254) && !(first === 172 && second >= 16 && second <= 31) && !(first === 192 && second === 168) && !(first === 198 && (second === 18 || second === 19));
+}
+function usableBlossomServers(values) {
+  const servers = [];
+  for (const value of values) {
     try {
-      url = new URL(customEmojiHref);
+      const [server] = normalizeUploadServers([value]);
+      if (server && !servers.includes(server)) servers.push(server);
     } catch {
-      return null;
     }
-    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
-    tags.push(["emoji", reaction.slice(1, -1), url.href]);
   }
-  return tags;
+  return servers;
 }
-function createPajaCommonBackend(options) {
-  const query = (filters, relays = options.getRelays()) => options.relay.query(relays, filters, PAJA_LIVE_QUERY_WAIT_MS);
-  const identity = async () => {
-    const active = options.getSigner();
-    if (!active?.getPublicKey) throw new Error("not-signed-in");
-    const activePubkey = (await active.getPublicKey()).toLowerCase();
-    if (!HEX_64.test(activePubkey)) throw new Error("not-signed-in");
-    return { signer: active, pubkey: activePubkey };
-  };
-  const signer = async () => {
-    const active = await identity();
-    if (!active.signer.signEvent) throw new Error("not-signed-in");
-    return active;
-  };
-  const currentContacts = async (author) => {
-    const events = await query([{ kinds: [3], authors: [author], limit: 16 }]);
-    return newestVerified(events, (event) => event.kind === 3 && event.pubkey.toLowerCase() === author);
-  };
-  const publish = async (active, author, template) => {
-    try {
-      const event = await active.signEvent(template);
-      if (event.pubkey.toLowerCase() !== author || !verifyEvent(event)) return { ok: false, error: "invalid-signature" };
-      await options.relay.publish(options.getRelays(), event);
-      return { ok: true, eventId: event.id, event };
-    } catch (error) {
-      return actionError(error);
-    }
-  };
-  const mutateFollows = async (values, add) => {
-    const targets = values.map(pubkey);
-    if (targets.some((target) => target === null)) return { ok: false, error: "invalid-pubkey" };
-    try {
-      const active = await signer();
-      const current = await currentContacts(active.pubkey);
-      const targetSet = new Set(targets);
-      const existing = new Set(contactPubkeys2(current));
-      const changed = add ? [...targetSet].some((target) => !existing.has(target)) : [...targetSet].some((target) => existing.has(target));
-      if (!changed) {
-        return current ? { ok: true, eventId: current.id, event: current } : { ok: true };
+async function readCappedResponse(response, signal) {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > PAJA_RESOURCE_MAX_BYTES) {
+    throw resourceTooLarge();
+  }
+  if (!response.body) {
+    const bytes2 = new Uint8Array(await response.arrayBuffer());
+    if (bytes2.byteLength > PAJA_RESOURCE_MAX_BYTES) throw resourceTooLarge();
+    return bytes2;
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      if (signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > PAJA_RESOURCE_MAX_BYTES) {
+        await reader.cancel();
+        throw resourceTooLarge();
       }
-      const tags = (current?.tags ?? []).filter((tag) => {
-        if (tag[0] !== "p" || typeof tag[1] !== "string") return true;
-        return add || !targetSet.has(tag[1].toLowerCase());
-      });
-      if (add) {
-        for (const target of targetSet) {
-          if (!existing.has(target)) tags.push(["p", target]);
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+function resourceTooLarge() {
+  return new ResourceServiceError("too-large", `resource exceeds ${PAJA_RESOURCE_MAX_BYTES} bytes`);
+}
+function isAbortError(error) {
+  return error instanceof Error && (error.name === "AbortError" || error.name === "DOMException");
+}
+function arrayBufferFor(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function encodedDataUrlLimit(maxBytes) {
+  return Math.ceil(maxBytes * 4 / 3) + 1024;
+}
+function startsWith(bytes, signature, offset = 0) {
+  return signature.every((value, index) => bytes[offset + index] === value);
+}
+function ascii(bytes, start, end) {
+  return String.fromCharCode(...bytes.subarray(start, end));
+}
+function sniffSafeResourceMime(bytes) {
+  if (startsWith(bytes, [137, 80, 78, 71, 13, 10, 26, 10])) return "image/png";
+  if (startsWith(bytes, [255, 216, 255])) return "image/jpeg";
+  if (ascii(bytes, 0, 6) === "GIF87a" || ascii(bytes, 0, 6) === "GIF89a") return "image/gif";
+  if (ascii(bytes, 0, 4) === "RIFF" && ascii(bytes, 8, 12) === "WEBP") return "image/webp";
+  if (ascii(bytes, 0, 4) === "RIFF" && ascii(bytes, 8, 12) === "WAVE") return "audio/wav";
+  if (ascii(bytes, 0, 4) === "OggS") return "audio/ogg";
+  if (ascii(bytes, 0, 3) === "ID3" || startsWith(bytes, [255, 251])) return "audio/mpeg";
+  if (startsWith(bytes, [26, 69, 223, 163])) return "video/webm";
+  if (ascii(bytes, 4, 8) === "ftyp") return "video/mp4";
+  if (ascii(bytes, 0, 4) === "wOFF") return "font/woff";
+  if (ascii(bytes, 0, 4) === "wOF2") return "font/woff2";
+  return sniffSafeTextMime(bytes);
+}
+function sniffSafeTextMime(bytes) {
+  let text;
+  try {
+    text = UTF8_DECODER.decode(bytes);
+  } catch {
+    return null;
+  }
+  if (/\u0000/u.test(text)) return null;
+  const normalized = text.trimStart().toLowerCase();
+  if (normalized.startsWith("<svg") || normalized.startsWith("<?xml") || normalized.startsWith("<!doctype html") || normalized.startsWith("<html") || normalized.startsWith("<script")) return null;
+  if (normalized.startsWith("{") || normalized.startsWith("[")) {
+    try {
+      JSON.parse(text);
+      return "application/json";
+    } catch {
+      return "text/plain";
+    }
+  }
+  return "text/plain";
+}
+
+// src/browser-blossom-events.ts
+var BLOSSOM_SERVER_LIST_KIND2 = 10063;
+var HEX_64 = /^[0-9a-f]{64}$/i;
+var BLOSSOM_REFERENCE = /^blossom:(?:sha256:)?([0-9a-f]{64})(?:\.[0-9a-z]+)?(?:\?([^#]*))?$/i;
+var DEFAULT_SERVER_LIST_TTL_MS = 5 * 6e4;
+var MAX_RESOURCES_PER_WINDOW = 256;
+var MAX_CONTEXTS_PER_RESOURCE = 8;
+function createPajaBlossomEventResolver(options) {
+  const now2 = options.now ?? Date.now;
+  const ttl = Math.max(0, options.serverListTtlMs ?? DEFAULT_SERVER_LIST_TTL_MS);
+  const windows = /* @__PURE__ */ new Map();
+  const serverLists = /* @__PURE__ */ new Map();
+  const pendingServerLists = /* @__PURE__ */ new Map();
+  function observe(windowId, results) {
+    if (!windowId) return;
+    let resources = windows.get(windowId);
+    if (!resources) {
+      resources = /* @__PURE__ */ new Map();
+      windows.set(windowId, resources);
+    }
+    for (const result2 of results) {
+      const publisher = normalizePubkey(result2.event.pubkey);
+      if (!publisher) continue;
+      for (const location of extractEventResourceLocations(result2.event)) {
+        if (!resources.has(location.url) && resources.size >= MAX_RESOURCES_PER_WINDOW) {
+          const oldest = resources.keys().next().value;
+          if (oldest) resources.delete(oldest);
         }
+        const contexts = resources.get(location.url) ?? [];
+        const next = {
+          ...location,
+          eventId: result2.event.id,
+          publisher,
+          createdAt: result2.event.created_at
+        };
+        const merged = [next, ...contexts.filter((context) => context.eventId !== next.eventId)].sort(compareResourceContext).slice(0, MAX_CONTEXTS_PER_RESOURCE);
+        resources.set(location.url, merged);
       }
-      return publish(active.signer, active.pubkey, {
-        kind: 3,
-        created_at: Math.floor(Date.now() / 1e3),
-        tags,
-        content: current?.content ?? ""
-      });
-    } catch (error) {
-      return actionError(error);
     }
-  };
-  return {
-    async getProfile(target) {
-      const resolved = profileTarget(target, options.getRelays());
-      if (!resolved) return { ok: false, pubkey: "", error: "invalid-profile-target" };
-      try {
-        const events = await query([{ kinds: [0], authors: [resolved.pubkey], limit: 16 }], resolved.relays);
-        const event = newestVerified(events, (candidate) => candidate.kind === 0 && candidate.pubkey.toLowerCase() === resolved.pubkey);
-        if (!event) return { ok: true, pubkey: resolved.pubkey, profile: null };
-        return {
-          ok: true,
-          pubkey: resolved.pubkey,
-          profile: parseProfile(event),
-          result: { event, sidecar: { relayHints: resolved.relays } }
+  }
+  function decorate(router, windowId) {
+    const getEvent = router.getEvent ? async (eventId, eventOptions) => {
+      const result2 = await router.getEvent(eventId, eventOptions);
+      if (result2.result) observe(windowId, [result2.result]);
+      return result2;
+    } : void 0;
+    return {
+      ...getEvent ? { getEvent } : {},
+      async query(filters, queryOptions) {
+        const result2 = await router.query(filters, queryOptions);
+        observe(windowId, result2.events);
+        return result2;
+      },
+      subscribe(filters, subscribeOptions, sink) {
+        const observingSink = {
+          event(result2) {
+            observe(windowId, [result2]);
+            sink.event(result2);
+          },
+          closed: (reason) => sink.closed(reason)
         };
-      } catch {
-        return { ok: false, pubkey: resolved.pubkey, error: "relay-timeout" };
-      }
-    },
-    async follows() {
-      try {
-        const active = await identity();
-        return { ok: true, pubkeys: contactPubkeys2(await currentContacts(active.pubkey)) };
-      } catch (error) {
-        const failure3 = actionError(error);
-        return { ok: false, pubkeys: [], error: failure3.error };
-      }
-    },
-    follow: (pubkeys) => mutateFollows(pubkeys, true),
-    unfollow: (pubkeys) => mutateFollows(pubkeys, false),
-    async react(targetEventId, reaction, customEmojiHref) {
-      if (!HEX_64.test(targetEventId)) return { ok: false, error: "invalid-target" };
-      try {
-        const active = await signer();
-        const events = await query([{ ids: [targetEventId], limit: 8 }]);
-        const target = newestVerified(events, (event) => event.id === targetEventId.toLowerCase());
-        if (!target) return { ok: false, error: "invalid-target" };
-        const tags = reactionTags(target, reaction, customEmojiHref);
-        if (!tags) return { ok: false, error: "invalid-reaction" };
-        return publish(active.signer, active.pubkey, {
-          kind: 7,
-          created_at: Math.floor(Date.now() / 1e3),
-          tags,
-          content: reaction
-        });
-      } catch (error) {
-        return actionError(error);
+        return router.subscribe(filters, subscribeOptions, observingSink);
+      },
+      publish: router.publish.bind(router),
+      resolveRelays: router.resolveRelays.bind(router)
+    };
+  }
+  async function getServers(url, windowId) {
+    const canonical = parseBlossomReference(url)?.url;
+    const contexts = canonical && windowId ? windows.get(windowId)?.get(canonical) ?? [] : [];
+    const servers = [];
+    for (const context of contexts) appendUnique(servers, context.servers);
+    if (servers.length < PAJA_RESOURCE_MAX_SERVERS) {
+      const hintedAuthors = [];
+      for (const context of contexts) appendUnique(hintedAuthors, context.authors);
+      const authors = [...hintedAuthors];
+      for (const context of contexts) appendUniqueWithoutLimit(authors, [context.publisher]);
+      const defaultAuthors = [];
+      for (const author of options.getDefaultAuthors?.() ?? []) {
+        const normalized = normalizePubkey(author);
+        if (normalized) appendUnique(defaultAuthors, [normalized]);
+      }
+      appendUniqueWithoutLimit(authors, defaultAuthors);
+      const lists = await Promise.all(
+        authors.map((author) => discoverServerList(author))
+      );
+      for (const list of lists) appendUnique(servers, list);
+    }
+    appendUnique(servers, options.getConfiguredServers());
+    return servers.slice(0, PAJA_RESOURCE_MAX_SERVERS);
+  }
+  async function discoverServerList(pubkey2) {
+    const cached = serverLists.get(pubkey2);
+    if (cached && cached.expiresAt > now2()) return [...cached.servers];
+    const pending = pendingServerLists.get(pubkey2);
+    if (pending) return [...await pending];
+    const lookup = loadServerList(pubkey2);
+    pendingServerLists.set(pubkey2, lookup);
+    try {
+      return [...await lookup];
+    } finally {
+      if (pendingServerLists.get(pubkey2) === lookup) pendingServerLists.delete(pubkey2);
+    }
+  }
+  async function loadServerList(pubkey2) {
+    let result2;
+    try {
+      result2 = await options.baseRouter.query(
+        [{ kinds: [BLOSSOM_SERVER_LIST_KIND2], authors: [pubkey2], limit: 1 }],
+        { authors: [pubkey2], limit: 1 }
+      );
+    } catch {
+      return [];
+    }
+    const newest = result2.events.map((entry) => entry.event).filter((event) => event.kind === BLOSSOM_SERVER_LIST_KIND2 && normalizePubkey(event.pubkey) === pubkey2).sort(compareNewestEvent)[0];
+    if (!newest) {
+      if (!result2.error && !result2.incomplete) {
+        serverLists.set(pubkey2, { expiresAt: now2() + ttl, servers: [] });
       }
-    },
-    async report(target, reason, text) {
-      try {
-        const active = await signer();
-        if (target.type === "pubkey") {
-          const reportedPubkey = pubkey(target.pubkey);
-          if (!reportedPubkey) return { ok: false, error: "invalid-target" };
-          return publish(active.signer, active.pubkey, {
-            kind: 1984,
-            created_at: Math.floor(Date.now() / 1e3),
-            tags: [["p", reportedPubkey, target.relay ?? "", reason]],
-            content: text
-          });
-        }
-        if (!HEX_64.test(target.id)) return { ok: false, error: "invalid-target" };
-        const explicitAuthor = target.pubkey ? pubkey(target.pubkey) : void 0;
-        if (target.pubkey && !explicitAuthor) return { ok: false, error: "invalid-target" };
-        let author = explicitAuthor ?? null;
-        if (!author) {
-          const events = await query([{ ids: [target.id], limit: 8 }]);
-          author = newestVerified(events, (event) => event.id === target.id.toLowerCase())?.pubkey ?? null;
+      return [];
+    }
+    const servers = newest.tags.flatMap((tag) => {
+      if (tag[0] !== "server" || typeof tag[1] !== "string") return [];
+      const server = normalizePublicBlossomServer(tag[1]);
+      return server ? [server] : [];
+    });
+    const deduplicated = [];
+    appendUnique(deduplicated, servers);
+    serverLists.set(pubkey2, { expiresAt: now2() + ttl, servers: deduplicated });
+    return deduplicated;
+  }
+  return {
+    observe,
+    decorate,
+    getServers,
+    clearWindow: (windowId) => windows.delete(windowId)
+  };
+}
+function extractEventResourceLocations(event) {
+  const locations = /* @__PURE__ */ new Map();
+  const globalServers = event.tags.flatMap((tag) => {
+    if (tag[0] !== "server" || typeof tag[1] !== "string") return [];
+    const server = normalizeEventServer(tag[1]);
+    return server ? [server] : [];
+  });
+  const add = (value, servers = [], authors = []) => {
+    if (!value) return;
+    const parsed = parseBlossomReference(value);
+    if (!parsed) return;
+    const existing = locations.get(parsed.url) ?? {
+      url: parsed.url,
+      servers: [],
+      authors: []
+    };
+    appendUnique(existing.servers, [
+      ...parsed.servers,
+      ...servers.flatMap((server) => {
+        const normalized = normalizeEventServer(server);
+        return normalized ? [normalized] : [];
+      }),
+      ...globalServers
+    ]);
+    appendUnique(existing.authors, [
+      ...parsed.authors,
+      ...authors.flatMap((author) => {
+        const normalized = normalizePubkey(author);
+        return normalized ? [normalized] : [];
+      })
+    ]);
+    locations.set(parsed.url, existing);
+  };
+  for (const tag of event.tags) {
+    if ((tag[0] === "resource" || tag[0] === "r") && typeof tag[1] === "string") {
+      add(tag[1]);
+    } else if (tag[0] === "blossom" && typeof tag[1] === "string") {
+      add(HEX_64.test(tag[1]) ? `blossom:sha256:${tag[1]}` : tag[1]);
+    }
+  }
+  const content = parseEventContent(event.content);
+  if (content) {
+    const contentServers = stringList2(content.servers);
+    for (const key of ["sources", "resources"]) {
+      const entries = content[key];
+      if (!Array.isArray(entries)) continue;
+      for (const entry of entries) {
+        if (typeof entry === "string") {
+          add(entry, contentServers);
+          continue;
         }
-        if (!author) return { ok: false, error: "author-unresolved" };
-        return publish(active.signer, active.pubkey, {
-          kind: 1984,
-          created_at: Math.floor(Date.now() / 1e3),
-          tags: [
-            ["e", target.id.toLowerCase(), target.relay ?? "", reason],
-            ["p", author.toLowerCase(), "", reason]
-          ],
-          content: text
-        });
-      } catch (error) {
-        return actionError(error);
+        if (!isRecord5(entry)) continue;
+        const value = stringValue(entry.uri) ?? stringValue(entry.url) ?? stringValue(entry.resource) ?? (isBlossomRecord(entry) && isHash(entry.sha256) ? `blossom:sha256:${String(entry.sha256)}` : void 0);
+        add(value, [...contentServers, ...stringList2(entry.servers)], stringList2(entry.authors));
       }
     }
+  }
+  return [...locations.values()];
+}
+function parseBlossomReference(value) {
+  const match = BLOSSOM_REFERENCE.exec(value.trim());
+  if (!match?.[1]) return null;
+  const params = new URLSearchParams(match[2] ?? "");
+  const servers = params.getAll("xs").flatMap((server) => {
+    const normalized = normalizeEventServer(server);
+    return normalized ? [normalized] : [];
+  });
+  const authors = params.getAll("as").flatMap((author) => {
+    const normalized = normalizePubkey(author);
+    return normalized ? [normalized] : [];
+  });
+  return {
+    url: `blossom:sha256:${match[1].toLowerCase()}`,
+    servers,
+    authors
   };
 }
+function normalizeEventServer(value) {
+  const normalized = normalizePublicBlossomServer(value);
+  if (normalized) return normalized;
+  const trimmed = value.trim();
+  if (!/^[a-z0-9.-]+(?::\d+)?$/i.test(trimmed)) return null;
+  return normalizePublicBlossomServer(`https://${trimmed}`);
+}
+function parseEventContent(value) {
+  if (!value.startsWith("{") || value.length > 256 * 1024) return null;
+  try {
+    const parsed = JSON.parse(value);
+    return isRecord5(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function compareResourceContext(left, right) {
+  if (left.createdAt !== right.createdAt) return right.createdAt - left.createdAt;
+  return left.eventId.localeCompare(right.eventId);
+}
+function compareNewestEvent(left, right) {
+  if (left.created_at !== right.created_at) return right.created_at - left.created_at;
+  return left.id.localeCompare(right.id);
+}
+function normalizePubkey(value) {
+  return typeof value === "string" && HEX_64.test(value) ? value.toLowerCase() : null;
+}
+function appendUnique(target, values) {
+  for (const value of values) {
+    if (!target.includes(value)) target.push(value);
+    if (target.length >= PAJA_RESOURCE_MAX_SERVERS) return;
+  }
+}
+function appendUniqueWithoutLimit(target, values) {
+  for (const value of values) {
+    if (!target.includes(value)) target.push(value);
+  }
+}
+function stringList2(value) {
+  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function isHash(value) {
+  return typeof value === "string" && HEX_64.test(value);
+}
+function isBlossomRecord(value) {
+  return value.type === "blossom" || value.kind === "blossom";
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null;
+}
 
-// src/browser-lists.ts
-var HEX_642 = /^[0-9a-f]{64}$/i;
-var ADDRESS = /^\d+:[0-9a-f]{64}:.+$/i;
-var SUPPORTED_LISTS = [
-  {
-    kind: 1e4,
-    type: "mute-list",
-    addressable: false,
-    supportedItemTypes: ["pubkey", "event", "hashtag", "word"],
-    privateItems: false,
-    tagByItemType: { pubkey: "p", event: "e", hashtag: "t", word: "word" }
-  },
-  {
-    kind: 10002,
-    type: "relay-list-metadata",
-    addressable: false,
-    supportedItemTypes: ["relay"],
-    privateItems: false,
-    tagByItemType: { relay: "r" }
-  },
-  {
-    kind: 10003,
-    type: "bookmarks",
-    addressable: false,
-    supportedItemTypes: ["event", "address"],
-    privateItems: false,
-    tagByItemType: { event: "e", address: "a" }
-  },
-  {
-    kind: 3e4,
-    type: "follow-sets",
-    addressable: true,
-    supportedItemTypes: ["pubkey"],
-    privateItems: false,
-    tagByItemType: { pubkey: "p" }
-  }
-];
-function publicSupport() {
-  return SUPPORTED_LISTS.map(({ tagByItemType: _tagByItemType, ...support }) => ({
-    ...support,
-    supportedItemTypes: support.supportedItemTypes ? [...support.supportedItemTypes] : void 0
-  }));
+// ../nip/dist/chunk-PSENX3MS.js
+function parseNip65RelayList(event) {
+  return event.tags.flatMap((tag) => {
+    if (tag[0] !== "r" || typeof tag[1] !== "string" || tag[1].length === 0) return [];
+    const marker = tag[2];
+    const read = marker !== "write";
+    const write = marker !== "read";
+    return [{ url: tag[1], read, write }];
+  });
 }
-function failure2(error, reason) {
-  return { ok: false, error, reason, supported: publicSupport() };
+function selectWriteRelays(entries) {
+  return dedupe(entries.filter((e) => e.write).map((e) => e.url));
 }
-function resolveList(ref) {
-  const input = ref;
-  const hasKind = typeof input.kind === "number";
-  const hasType = typeof input.type === "string" && input.type.length > 0;
-  if (hasKind === hasType) return failure2("invalid-list-ref", "exactly one list kind or type is required");
-  const candidates = hasKind ? SUPPORTED_LISTS.filter((support2) => support2.kind === input.kind) : SUPPORTED_LISTS.filter((support2) => support2.type === input.type);
-  if (candidates.length === 0) return failure2("unsupported-list", "list kind or type is not supported");
-  if (candidates.length > 1) return failure2("ambiguous-list", "list type maps to multiple supported kinds");
-  const support = candidates[0];
-  const identifier = typeof input.identifier === "string" && input.identifier.length > 0 ? input.identifier : void 0;
-  if (support.addressable && !identifier) return failure2("missing-identifier", "addressable lists require an identifier");
-  if (!support.addressable && identifier) return failure2("invalid-list-ref", "replaceable list does not accept an identifier");
-  return { support, ...identifier ? { identifier } : {} };
+function selectReadRelays(entries) {
+  return dedupe(entries.filter((e) => e.read).map((e) => e.url));
 }
-function relayUrl(value) {
-  try {
-    const parsed = new URL(value);
-    return parsed.protocol === "ws:" || parsed.protocol === "wss:" ? parsed.href : null;
-  } catch {
-    return null;
+function createNip65Registry() {
+  const lists = /* @__PURE__ */ new Map();
+  function setRelayList(pubkey2, entries) {
+    lists.set(pubkey2, entries.map((e) => ({ ...e })));
   }
-}
-function itemTag(support, item) {
-  if (item.visibility === "private") return failure2("private-items-unsupported", "private list items require NIP-44 support");
-  const tagName = support.tagByItemType[item.itemType];
-  if (!tagName) return failure2("unsupported-item", `${item.itemType} is not supported by ${support.type}`);
-  const value = item.value.trim();
-  if (!value) return failure2("invalid-item", "list item value is empty");
-  if ((item.itemType === "pubkey" || item.itemType === "event") && !HEX_642.test(value)) {
-    return failure2("invalid-item", `${item.itemType} values must be 32-byte hex`);
+  function ingest(event) {
+    const entries = parseNip65RelayList(event);
+    setRelayList(event.pubkey, entries);
+    return entries;
   }
-  if (item.itemType === "address" && !ADDRESS.test(value)) {
-    return failure2("invalid-item", "address values must use kind:pubkey:identifier");
+  function getRelayList(pubkey2) {
+    const entries = lists.get(pubkey2);
+    return entries ? entries.map((e) => ({ ...e })) : void 0;
   }
-  if (support.kind === 10002) {
-    const url = relayUrl(value);
-    if (!url) return failure2("invalid-item", "relay list items require ws or wss URLs");
-    const marker = item.marker ?? "read-write";
-    if (marker !== "read" && marker !== "write" && marker !== "read-write") {
-      return failure2("invalid-item", "relay marker must be read, write, or read-write");
+  function resolve(pubkeys, want) {
+    const urls = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const pubkey2 of pubkeys) {
+      const entries = lists.get(pubkey2);
+      if (!entries) continue;
+      for (const entry of entries) {
+        if (entry[want] && !seen.has(entry.url)) {
+          seen.add(entry.url);
+          urls.push(entry.url);
+        }
+      }
     }
-    return marker === "read-write" ? ["r", url] : ["r", url, marker];
+    return urls;
   }
-  const tag = [tagName, value];
-  if (item.relay) tag.push(item.relay);
-  if (item.label) tag.push(item.label);
-  return tag;
+  return {
+    ingest,
+    setRelayList,
+    getRelayList,
+    has: (pubkey2) => lists.has(pubkey2),
+    resolveOutboxRelays: (pubkeys) => resolve(pubkeys, "write"),
+    resolveReadRelays: (pubkeys) => resolve(pubkeys, "read"),
+    delete: (pubkey2) => lists.delete(pubkey2),
+    clear: () => lists.clear()
+  };
 }
-function isFailure(value) {
-  return !Array.isArray(value);
+function dedupe(urls) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const url of urls) {
+    if (!seen.has(url)) {
+      seen.add(url);
+      out.push(url);
+    }
+  }
+  return out;
 }
-function sameItem(tag, expected) {
-  if (tag[0] !== expected[0] || tag[1] !== expected[1]) return false;
-  if (expected.length > 2 && tag[2] !== expected[2]) return false;
-  if (expected.length > 3 && tag[3] !== expected[3]) return false;
+
+// src/browser-relay-runtime.ts
+var PAJA_NIP65_RELAY_LIST_KIND = 10002;
+var PAJA_CONTACT_LIST_KIND = 3;
+var PAJA_WEBRTC_SIGNAL_KIND = 25050;
+var NIP17_GIFT_WRAP_KIND2 = 1059;
+var PAJA_CONTACT_LIST_CANDIDATE_LIMIT = 64;
+var PAJA_LIVE_QUERY_WAIT_MS = 4e3;
+var contactListCandidateQueries = /* @__PURE__ */ new WeakMap();
+function matchesFilter2(event, filter) {
+  const ids = filter.ids;
+  if (ids && !ids.some((id) => event.id === id || event.id.startsWith(id))) return false;
+  const authors = filter.authors;
+  if (authors && !authors.some((author) => event.pubkey === author || event.pubkey.startsWith(author))) return false;
+  const kinds = filter.kinds;
+  if (kinds && !kinds.includes(event.kind)) return false;
+  if (typeof filter.since === "number" && event.created_at < filter.since) return false;
+  if (typeof filter.until === "number" && event.created_at > filter.until) return false;
+  for (const [key, value] of Object.entries(filter)) {
+    if (!key.startsWith("#") || !Array.isArray(value)) continue;
+    const tagName = key.slice(1);
+    const allowed2 = value.filter((item) => typeof item === "string");
+    if (allowed2.length === 0) continue;
+    if (!event.tags.some((tag) => tag[0] === tagName && typeof tag[1] === "string" && allowed2.includes(tag[1]))) return false;
+  }
   return true;
 }
-function relayCoverage(tag) {
-  if (tag[2] === "read") return /* @__PURE__ */ new Set(["read"]);
-  if (tag[2] === "write") return /* @__PURE__ */ new Set(["write"]);
-  return /* @__PURE__ */ new Set(["read", "write"]);
-}
-function relayTag(url, coverage) {
-  if (coverage.size === 0) return null;
-  if (coverage.size === 2) return ["r", url];
-  return ["r", url, coverage.has("read") ? "read" : "write"];
-}
-function sameRelay(tag, url) {
-  return tag[0] === "r" && typeof tag[1] === "string" && relayUrl(tag[1]) === url;
+function matchesAnyFilter2(event, filters) {
+  return filters.length === 0 || filters.some((filter) => matchesFilter2(event, filter));
 }
-function addRelayItem(tags, expected) {
-  const url = expected[1];
-  const matching = tags.filter((tag) => sameRelay(tag, url));
-  const coverage = /* @__PURE__ */ new Set();
-  for (const tag of matching) for (const direction of relayCoverage(tag)) coverage.add(direction);
-  const requested = relayCoverage(expected);
-  const before = coverage.size;
-  for (const direction of requested) coverage.add(direction);
-  if (coverage.size === before) return { tags, changed: false };
-  const retained = tags.filter((tag) => !sameRelay(tag, url));
-  retained.push(relayTag(url, coverage));
-  return { tags: retained, changed: true };
+function normalizedFilters(filters) {
+  return Array.isArray(filters) ? filters : [filters];
 }
-function removeRelayItem(tags, expected) {
-  const url = expected[1];
-  const matching = tags.filter((tag) => sameRelay(tag, url));
-  if (matching.length === 0) return { tags, changed: false };
-  const retained = tags.filter((tag) => !sameRelay(tag, url));
-  if (expected.length === 2) return { tags: retained, changed: true };
-  const coverage = /* @__PURE__ */ new Set();
-  for (const tag of matching) for (const direction of relayCoverage(tag)) coverage.add(direction);
-  coverage.delete(expected[2]);
-  const rewritten = relayTag(url, coverage);
-  if (rewritten) retained.push(rewritten);
-  return { tags: retained, changed: true };
+function applyFilterLimit(events, filter) {
+  const limit = typeof filter.limit === "number" && filter.limit >= 0 ? filter.limit : void 0;
+  if (limit === void 0) return events;
+  return [...events].sort((a, b) => b.created_at - a.created_at).slice(0, limit);
 }
-function metadataTags(resolved, options) {
-  const tags = [];
-  if (resolved.identifier) tags.push(["d", resolved.identifier]);
-  if (options?.title) tags.push(["title", options.title]);
-  if (options?.description) tags.push(["description", options.description]);
-  if (options?.image) tags.push(["image", options.image]);
-  return tags;
+function collectMemoryEvents(events, filters) {
+  const out = /* @__PURE__ */ new Map();
+  const activeFilters = filters.length > 0 ? filters : [{}];
+  for (const filter of activeFilters) {
+    for (const event of applyFilterLimit(events.filter((candidate) => matchesFilter2(candidate, filter)), filter)) {
+      out.set(event.id, event);
+    }
+  }
+  return [...out.values()].sort((a, b) => b.created_at - a.created_at);
 }
-function listFilter(resolved, author) {
+function subscribeLive(pool, relayUrls2, filters, next) {
+  const activeFilters = filters.length > 0 ? filters : [{}];
+  const requests = relayUrls2.flatMap((url) => activeFilters.map((filter) => ({ url, filter })));
+  if (requests.length === 0) {
+    queueMicrotask(() => next("EOSE"));
+    return { unsubscribe() {
+    } };
+  }
+  const sub = pool.subscribeMap(requests, {
+    label: "kehto-paja-runtime",
+    maxWait: PAJA_LIVE_QUERY_WAIT_MS,
+    onevent: (event) => next(event),
+    oneose: () => next("EOSE")
+  });
   return {
-    kinds: [resolved.support.kind],
-    authors: [author],
-    limit: 16,
-    ...resolved.identifier ? { ["#d"]: [resolved.identifier] } : {}
+    unsubscribe() {
+      void sub.close("paja unsubscribe");
+    }
   };
 }
-function newestList(events, resolved, author) {
-  return events.filter((event) => event.kind === resolved.support.kind && event.pubkey.toLowerCase() === author && (!resolved.identifier || event.tags.some((tag) => tag[0] === "d" && tag[1] === resolved.identifier)) && verifyEvent(event)).sort((left, right) => right.created_at - left.created_at || left.id.localeCompare(right.id))[0] ?? null;
-}
-function createPajaListsBackend(options) {
-  const activeSigner = async () => {
-    const signer = options.getSigner();
-    if (!signer?.getPublicKey || !signer.signEvent) throw new Error("not-signed-in");
-    const pubkey2 = (await signer.getPublicKey()).toLowerCase();
-    if (!HEX_642.test(pubkey2)) throw new Error("not-signed-in");
-    return { signer, pubkey: pubkey2 };
-  };
-  const mutation = async (operation, ref, items, mutationOptions) => {
-    const resolved = resolveList(ref);
-    if ("ok" in resolved) return resolved;
-    if (items.length === 0) return { ok: true, [operation === "add" ? "added" : "removed"]: 0, skipped: 0 };
-    const itemTags = [];
-    for (const item of items) {
-      const tag = itemTag(resolved.support, item);
-      if (isFailure(tag)) return tag;
-      itemTags.push(tag);
-    }
-    let active;
+function queryLiveBounded(pool, relayUrls2, filter, maxWaitMs, limit, signal) {
+  if (limit === 0 || signal?.aborted) return Promise.resolve([]);
+  return new Promise((resolve) => {
+    const events = [];
+    let settled = false;
+    let closeRequested = false;
+    let closeReason = "paja query limit reached";
+    let subscription;
+    let abort;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      if (abort) signal?.removeEventListener("abort", abort);
+      resolve(events);
+    };
+    const close = (reason = closeReason) => {
+      closeRequested = true;
+      closeReason = reason;
+      if (!subscription) return;
+      void Promise.resolve(subscription.close(reason)).catch(() => {
+      });
+      finish();
+    };
+    abort = () => close("paja query aborted");
+    signal?.addEventListener("abort", abort, { once: true });
+    subscription = pool.subscribeEose(relayUrls2, filter, {
+      label: "kehto-paja-runtime",
+      maxWait: maxWaitMs,
+      onevent(event) {
+        if (events.length >= limit) return;
+        events.push(event);
+        if (events.length === limit) close();
+      },
+      onclose: finish
+    });
+    if (closeRequested) close();
+  });
+}
+async function queryLive(pool, relayUrls2, filters, maxWaitMs = PAJA_LIVE_QUERY_WAIT_MS, collectUntilLimit = false, signal) {
+  const activeFilters = filters.length > 0 ? filters : [{}];
+  const batches = await Promise.all(activeFilters.map((filter) => {
+    const limit = typeof filter.limit === "number" && filter.limit >= 0 ? filter.limit : void 0;
+    if (collectUntilLimit && limit !== void 0) return queryLiveBounded(pool, relayUrls2, filter, maxWaitMs, limit, signal);
+    return pool.querySync(relayUrls2, filter, {
+      label: "kehto-paja-runtime",
+      maxWait: maxWaitMs
+    });
+  }));
+  const out = /* @__PURE__ */ new Map();
+  for (const event of batches.flat()) out.set(event.id, event);
+  return [...out.values()].sort((a, b) => b.created_at - a.created_at);
+}
+async function publishLive(pool, relayUrls2, event) {
+  const results = await Promise.allSettled(pool.publish(relayUrls2, event));
+  return Object.fromEntries(relayUrls2.map((relayUrl2, index) => [relayUrl2, results[index]?.status === "fulfilled"]));
+}
+async function countLive(pool, relayUrls2, filters) {
+  let failure3 = new Error("count unavailable");
+  for (const relayUrl2 of relayUrls2) {
+    const controller = new AbortController();
+    let timeout;
+    const timedOut = new Promise((_resolve, reject2) => {
+      timeout = setTimeout(() => {
+        controller.abort();
+        reject2(new Error("count timeout"));
+      }, PAJA_LIVE_QUERY_WAIT_MS);
+    });
     try {
-      active = await activeSigner();
-    } catch {
-      return failure2("not-signed-in", "list mutations require an active signer");
+      const relay = await Promise.race([
+        pool.ensureRelay(relayUrl2, {
+          connectionTimeout: PAJA_LIVE_QUERY_WAIT_MS,
+          abort: controller.signal
+        }),
+        timedOut
+      ]);
+      const count = await Promise.race([
+        relay.count(filters, { id: null }),
+        timedOut
+      ]);
+      if (!Number.isSafeInteger(count) || count < 0) throw new Error("invalid count");
+      return { count, relay: relayUrl2 };
+    } catch (error) {
+      failure3 = error;
+    } finally {
+      if (timeout !== void 0) clearTimeout(timeout);
     }
-    let current;
-    try {
-      const events = await options.relay.query(
-        options.getRelays(),
-        [listFilter(resolved, active.pubkey)],
-        PAJA_LIVE_QUERY_WAIT_MS
-      );
-      current = newestList(events, resolved, active.pubkey);
-    } catch {
-      return failure2("list-unavailable", "current list could not be loaded");
+  }
+  throw failure3;
+}
+function createPajaRelayBackend(getSimulation, confirmRequest, livePool = new SimplePool()) {
+  livePool.trackRelays = true;
+  const fixtureEvents = getSimulation().relay.fixtures.flatMap(toNostrEvent);
+  const acceptedMemoryEvents = [];
+  const subscribers = /* @__PURE__ */ new Set();
+  const isAvailable = () => getSimulation().relay.mode !== "disabled" && getPajaRelayUrls(getSimulation()).length > 0;
+  const cachedEvents = () => getSimulation().relay.mode === "memory" ? [...fixtureEvents, ...acceptedMemoryEvents] : [];
+  const query = async (relayUrls2, filters, maxWaitMs) => {
+    const cached = collectMemoryEvents(cachedEvents(), filters);
+    if (getSimulation().relay.mode !== "live" || relayUrls2.length === 0) return cached;
+    const liveEvents = await queryLive(livePool, relayUrls2, filters, maxWaitMs);
+    const out = /* @__PURE__ */ new Map();
+    for (const event of [...cached, ...liveEvents]) out.set(event.id, event);
+    return [...out.values()].sort((a, b) => b.created_at - a.created_at);
+  };
+  const queryContactListCandidates = async (relayUrls2, filters, maxWaitMs, signal) => {
+    const cached = collectMemoryEvents(cachedEvents(), filters);
+    if (signal?.aborted || getSimulation().relay.mode !== "live" || relayUrls2.length === 0) return cached;
+    const liveEvents = await queryLive(livePool, relayUrls2, filters, maxWaitMs, true, signal);
+    const out = /* @__PURE__ */ new Map();
+    for (const event of [...cached, ...liveEvents]) out.set(event.id, event);
+    return [...out.values()].sort((a, b) => b.created_at - a.created_at);
+  };
+  function retainPublishedEvent(event, mode) {
+    if (mode !== "memory") return;
+    acceptedMemoryEvents.push(event);
+    for (const subscriber of subscribers) {
+      if (matchesAnyFilter2(event, subscriber.filters)) subscriber.next(event);
     }
-    if (!current && !(operation === "add" && mutationOptions?.create)) {
-      return failure2("list-not-found", "list does not exist and creation was not requested");
+  }
+  async function attemptPublish(relayUrls2, event) {
+    const simulation = getSimulation();
+    const rejected = Object.fromEntries(relayUrls2.map((url) => [url, false]));
+    if (simulation.relay.mode === "disabled") {
+      return { outcomes: rejected, error: "relay unavailable" };
     }
-    if (operation === "remove" && current?.content && items.some((item) => item.visibility !== "public")) {
-      return failure2("private-items-unsupported", "cannot safely remove private items without NIP-44 support");
+    if (!await confirmRequest({ action: "publish", event })) {
+      return { outcomes: rejected, error: "publish denied" };
     }
-    let tags = current ? current.tags.map((tag) => [...tag]) : metadataTags(resolved, mutationOptions);
-    let changed = 0;
-    for (const expected of itemTags) {
-      if (resolved.support.kind === 10002) {
-        const result2 = operation === "add" ? addRelayItem(tags, expected) : removeRelayItem(tags, expected);
-        tags = result2.tags;
-        if (result2.changed) changed += 1;
-        continue;
-      }
-      if (operation === "add") {
-        if (!tags.some((tag) => sameItem(tag, expected))) {
-          tags.push(expected);
-          changed += 1;
-        }
-      } else {
-        const before = tags.length;
-        tags = tags.filter((tag) => !sameItem(tag, expected));
-        if (tags.length < before) changed += 1;
-      }
+    const outcomes = simulation.relay.mode === "live" ? await publishLive(livePool, relayUrls2, event) : Object.fromEntries(relayUrls2.map((url) => [url, true]));
+    if (!Object.values(outcomes).some(Boolean)) {
+      return { outcomes, error: "publish failed" };
     }
-    const skipped = items.length - changed;
-    if (changed === 0) {
+    retainPublishedEvent(event, simulation.relay.mode);
+    return { outcomes };
+  }
+  const backend = {
+    subscription(relayUrls2, filtersInput) {
       return {
-        ok: true,
-        ...current ? { eventId: current.id, event: { ...current } } : {},
-        [operation === "add" ? "added" : "removed"]: 0,
-        skipped
-      };
-    }
-    try {
-      const template = {
-        kind: resolved.support.kind,
-        created_at: Math.floor(Date.now() / 1e3),
-        tags,
-        content: current?.content ?? ""
+        subscribe(next) {
+          const filters = normalizedFilters(filtersInput);
+          const subscriber = {
+            filters,
+            next: (item) => next(item)
+          };
+          subscribers.add(subscriber);
+          for (const event of collectMemoryEvents(cachedEvents(), filters)) next(event);
+          const liveSub = getSimulation().relay.mode === "live" ? subscribeLive(livePool, relayUrls2, filters, subscriber.next) : null;
+          queueMicrotask(() => {
+            if (subscribers.has(subscriber) && !liveSub) next("EOSE");
+          });
+          return {
+            unsubscribe() {
+              subscribers.delete(subscriber);
+              liveSub?.unsubscribe();
+            }
+          };
+        }
       };
-      const event = await active.signer.signEvent(template);
-      if (event.pubkey.toLowerCase() !== active.pubkey || !verifyEvent(event)) {
-        return failure2("publish-failed", "signer returned an invalid list event");
-      }
-      await options.relay.publish(options.getRelays(), event);
+    },
+    async publish(relayUrls2, event) {
+      const attempt = await attemptPublish(relayUrls2, event);
+      if (attempt.error) throw new Error(attempt.error);
+    },
+    request(relayUrls2, filtersInput) {
       return {
-        ok: true,
-        eventId: event.id,
-        event: { ...event },
-        [operation === "add" ? "added" : "removed"]: changed,
-        skipped
+        subscribe(observer) {
+          const filters = normalizedFilters(filtersInput);
+          let active = true;
+          query(relayUrls2, filters).then((matched) => {
+            if (!active) return;
+            for (const event of matched) observer.next(event);
+            observer.complete();
+          }).catch(() => {
+            if (active) observer.error();
+          });
+          return { unsubscribe() {
+            active = false;
+          } };
+        }
       };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      return failure2(message.includes("denied") ? "user-denied" : "publish-failed", message);
+    },
+    async count(relayUrls2, filters) {
+      if (getSimulation().relay.mode !== "live") throw new Error("count unavailable");
+      return (await countLive(livePool, relayUrls2, normalizedFilters(filters))).count;
+    },
+    async countWithRelay(relayUrls2, filters) {
+      if (getSimulation().relay.mode !== "live") throw new Error("count unavailable");
+      return countLive(livePool, relayUrls2, normalizedFilters(filters));
+    },
+    observedRelayUrls(eventId) {
+      return [...livePool.seenOn?.get(eventId) ?? []].map((relay) => relay.url);
+    },
+    query,
+    async publishToRelays(relayUrls2, event) {
+      return (await attemptPublish(relayUrls2, event)).outcomes;
+    },
+    async publishWebrtcSignal(relayUrls2, event) {
+      if (getSimulation().relay.mode !== "live" || relayUrls2.length === 0 || event.kind !== PAJA_WEBRTC_SIGNAL_KIND || !verifyEvent(event)) {
+        throw new Error("signaling unavailable");
+      }
+      const outcomes = await publishLive(livePool, relayUrls2, event);
+      if (!Object.values(outcomes).some(Boolean)) throw new Error("signaling unavailable");
+      retainPublishedEvent(event, "live");
+    },
+    async publishDmGiftWrap(relayUrls2, event) {
+      if (getSimulation().relay.mode !== "live" || relayUrls2.length === 0 || event.kind !== NIP17_GIFT_WRAP_KIND2 || !verifyEvent(event)) {
+        throw new Error("DM relay publication failed");
+      }
+      const outcomes = await publishLive(livePool, relayUrls2, event);
+      if (!Object.values(outcomes).some(Boolean)) throw new Error("DM relay publication failed");
+      retainPublishedEvent(event, "live");
+    },
+    isAvailable,
+    close() {
+      livePool.destroy();
     }
   };
-  return {
-    supported: publicSupport,
-    add: (list, items, mutationOptions) => mutation("add", list, items, mutationOptions),
-    remove: (list, items, mutationOptions) => mutation("remove", list, items, mutationOptions)
-  };
-}
-
-// ../nip/dist/chunk-JT5WCCCX.js
-function computeAggregateHash(entries) {
-  const lines = entries.map((entry) => `${entry.sha256} ${entry.path}
-`);
-  lines.sort();
-  return bytesToHex2(sha256(new TextEncoder().encode(lines.join(""))));
-}
-function pathEntriesFromTags(tags) {
-  const entries = [];
-  for (const tag of tags) {
-    if (tag[0] === "path" && typeof tag[1] === "string" && typeof tag[2] === "string" && tag[1].length > 0 && tag[2].length > 0) {
-      entries.push({ path: tag[1], sha256: tag[2] });
-    }
-  }
-  return entries;
+  contactListCandidateQueries.set(backend, queryContactListCandidates);
+  return backend;
 }
-function aggregateTagValue(tags) {
-  for (const tag of tags) {
-    if (tag[0] === "x" && tag[2] === "aggregate" && typeof tag[1] === "string" && tag[1].length > 0) {
-      return tag[1];
-    }
+function toNostrEvent(value) {
+  if (typeof value === "object" && value !== null && typeof value.id === "string" && typeof value.pubkey === "string" && typeof value.kind === "number" && Array.isArray(value.tags) && typeof value.content === "string" && typeof value.sig === "string") {
+    return [value];
   }
-  return void 0;
-}
-
-// ../nip/dist/chunk-F6ABV5KZ.js
-var MIB = 1024 * 1024;
-var NAPPLET_ARTIFACT_CACHE_NAME = "kehto:napplet-artifacts:v1";
-var SCHEMA_VERSION = 1;
-var DEFAULT_BASE_URL = "https://kehto.invalid";
-var DEFAULT_UNKNOWN_BUDGET_BYTES = 32 * MIB;
-var DEFAULT_SOFT_CEILING_BYTES = 128 * MIB;
-var DEFAULT_HARD_CEILING_BYTES = 256 * MIB;
-var DEFAULT_FOREGROUND_TTL_MS = 15 * 60 * 1e3;
-var DEFAULT_BACKGROUND_TTL_MS = 60 * 60 * 1e3;
-function emptyIndex(now2) {
-  return {
-    schemaVersion: SCHEMA_VERSION,
-    updatedAt: now2,
-    blobs: {},
-    aggregates: {},
-    coordinates: {}
-  };
-}
-function aggregateKey(dTag, aggregateHash) {
-  return `${encodeURIComponent(dTag)}:${aggregateHash}`;
-}
-function coordinateKey(kind, pubkey2, dTag) {
-  return `${kind}:${pubkey2}:${encodeURIComponent(dTag)}`;
-}
-function isCoordinateFresh(coordinate, options = {}) {
-  const now2 = options.now ?? Date.now();
-  const ttl = options.background ? coordinate.backgroundTtlMs : coordinate.foregroundTtlMs;
-  return ttl === Number.POSITIVE_INFINITY || now2 - coordinate.lastResolvedAt <= ttl;
-}
-function byteLength2(bytes) {
-  return bytes.byteLength;
-}
-function encodeKeyPart(value) {
-  return encodeURIComponent(value).replaceAll("%2F", "%252F");
-}
-function cloneBytes(bytes) {
-  return new Uint8Array(bytes);
-}
-function responseBody(bytes) {
-  return cloneBytes(bytes).buffer;
+  return [];
 }
-function normalizeBaseUrl(baseUrl) {
-  return baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+function getPajaRelayUrls(simulation) {
+  return simulation.relay.mode === "disabled" ? [] : [...simulation.relay.urls];
 }
-function resolveBaseUrl(baseUrl) {
-  if (baseUrl) return normalizeBaseUrl(baseUrl);
-  const maybeLocation = globalThis;
-  if (maybeLocation.location?.origin) return normalizeBaseUrl(maybeLocation.location.origin);
-  return normalizeBaseUrl(DEFAULT_BASE_URL);
+function dedupeRelayUrls(urls) {
+  const out = /* @__PURE__ */ new Set();
+  for (const url of urls) {
+    const trimmed = url.trim();
+    if (trimmed.length > 0) out.add(trimmed);
+  }
+  return [...out];
 }
-async function responseBytes(response) {
-  return new Uint8Array(await response.arrayBuffer());
+async function getSignerRelayUrls(signerProvider, direction) {
+  const signer = signerProvider?.getSigner();
+  if (!signer?.getRelays) return [];
+  try {
+    const relays = await signer.getRelays();
+    return dedupeRelayUrls(Object.entries(relays).flatMap(([url, permissions]) => {
+      if (direction === "read" && permissions.read) return [url];
+      if (direction === "write" && permissions.write) return [url];
+      return [];
+    }));
+  } catch {
+    return [];
+  }
 }
-async function responseJson(response) {
-  return response.json();
+async function getBootstrapRelayUrls(getSimulation, signerProvider, getHostRelayUrls) {
+  return dedupeRelayUrls([
+    ...getHostRelayUrls?.() ?? getPajaRelayUrls(getSimulation()),
+    ...await getSignerRelayUrls(signerProvider, "read")
+  ]);
 }
-function refCounts(index) {
-  const counts = {};
-  for (const aggregate of Object.values(index.aggregates)) {
-    for (const hash of aggregate.blobHashes) counts[hash] = (counts[hash] ?? 0) + 1;
-  }
-  return counts;
+function createPajaContactListLoader(backend, getSimulation, signerProvider, getHostRelayUrls) {
+  return async (pubkey2, signal) => {
+    if (!/^[0-9a-fA-F]{64}$/.test(pubkey2) || signal?.aborted) return [];
+    const relayUrls2 = await getBootstrapRelayUrls(getSimulation, signerProvider, getHostRelayUrls);
+    if (signal?.aborted) return [];
+    const filters = [{
+      kinds: [PAJA_CONTACT_LIST_KIND],
+      authors: [pubkey2],
+      limit: PAJA_CONTACT_LIST_CANDIDATE_LIMIT
+    }];
+    const contactQuery = contactListCandidateQueries.get(backend);
+    const candidates = contactQuery ? await contactQuery(relayUrls2, filters, PAJA_LIVE_QUERY_WAIT_MS, signal) : await backend.query(relayUrls2, filters, PAJA_LIVE_QUERY_WAIT_MS);
+    if (signal?.aborted) return [];
+    return candidates.filter((event) => event.kind === PAJA_CONTACT_LIST_KIND && event.pubkey.toLowerCase() === pubkey2.toLowerCase()).sort((left, right) => right.created_at - left.created_at || left.id.localeCompare(right.id)).slice(0, PAJA_CONTACT_LIST_CANDIDATE_LIMIT);
+  };
 }
-function cachedSize(index) {
-  const blobBytes = Object.values(index.blobs).reduce((sum, entry) => sum + entry.size, 0);
-  const aggregateBytes = Object.values(index.aggregates).reduce((sum, entry) => sum + entry.size, 0);
-  return blobBytes + aggregateBytes;
+function latestEvent(events, kind, pubkey2) {
+  return events.filter((event) => event.kind === kind && event.pubkey === pubkey2).sort((a, b) => b.created_at - a.created_at)[0];
 }
-var CacheStorageNappletArtifactCache = class {
-  cacheStorage;
-  storage;
-  cacheName;
-  baseUrl;
-  now;
-  activeAggregates = /* @__PURE__ */ new Set();
-  onDiagnostic;
-  unknownBudgetBytes;
-  softCeilingBytes;
-  hardCeilingBytes;
-  cachePromise;
-  constructor(options = {}) {
-    const maybeCacheStorage = options.cacheStorage ?? globalThis.caches;
-    if (!maybeCacheStorage) {
-      throw new Error("Cache Storage is unavailable");
-    }
-    this.cacheStorage = maybeCacheStorage;
-    this.storage = options.storage ?? globalThis.navigator?.storage;
-    this.cacheName = options.cacheName ?? NAPPLET_ARTIFACT_CACHE_NAME;
-    this.baseUrl = resolveBaseUrl(options.baseUrl);
-    this.now = options.now ?? Date.now;
-    this.onDiagnostic = options.onDiagnostic;
-    this.unknownBudgetBytes = options.unknownBudgetBytes ?? DEFAULT_UNKNOWN_BUDGET_BYTES;
-    this.softCeilingBytes = options.softCeilingBytes ?? DEFAULT_SOFT_CEILING_BYTES;
-    this.hardCeilingBytes = options.hardCeilingBytes ?? DEFAULT_HARD_CEILING_BYTES;
-  }
-  async readBlob(sha256Hex) {
-    try {
-      const cache2 = await this.open();
-      const response = await cache2.match(this.blobUrl(sha256Hex));
-      if (!response) return void 0;
-      const bytes = await responseBytes(response);
-      const index = await this.readIndex(cache2);
-      const entry = index.blobs[sha256Hex];
-      if (entry) {
-        entry.lastAccessed = this.now();
-        index.updatedAt = entry.lastAccessed;
-        await this.writeIndex(cache2, index);
+function createPajaRelayListLoader(backend, getSimulation, signerProvider, getHostRelayUrls) {
+  const registry2 = createNip65Registry();
+  return async (pubkeys) => {
+    const uniquePubkeys = [...new Set(pubkeys.filter((pubkey2) => /^[0-9a-fA-F]{64}$/.test(pubkey2)))];
+    const missing = uniquePubkeys.filter((pubkey2) => !registry2.has(pubkey2));
+    if (missing.length > 0) {
+      const events = await backend.query(await getBootstrapRelayUrls(
+        getSimulation,
+        signerProvider,
+        getHostRelayUrls
+      ), [{
+        kinds: [PAJA_NIP65_RELAY_LIST_KIND],
+        authors: missing,
+        limit: Math.max(missing.length * 2, 10)
+      }], PAJA_LIVE_QUERY_WAIT_MS);
+      for (const pubkey2 of missing) {
+        const event = latestEvent(events, PAJA_NIP65_RELAY_LIST_KIND, pubkey2);
+        if (event) registry2.ingest(event);
       }
-      return bytes;
-    } catch (cause) {
-      this.diagnostic({ type: "cache-read-failed", message: `failed to read blob ${sha256Hex}`, cause });
-      return void 0;
-    }
-  }
-  async deleteBlob(sha256Hex) {
-    try {
-      const cache2 = await this.open();
-      await cache2.delete(this.blobUrl(sha256Hex));
-      const index = await this.readIndex(cache2);
-      delete index.blobs[sha256Hex];
-      index.updatedAt = this.now();
-      await this.writeIndex(cache2, index);
-    } catch (cause) {
-      this.diagnostic({ type: "cache-delete-failed", message: `failed to delete blob ${sha256Hex}`, cause });
     }
-  }
-  async writeVerifiedResolution(input) {
-    try {
-      await this.writeVerifiedResolutionOnce(input);
-    } catch (firstCause) {
-      try {
-        await this.prune(input.now ?? this.now());
-        await this.writeVerifiedResolutionOnce(input);
-      } catch (cause) {
-        this.diagnostic({
-          type: "cache-write-failed",
-          message: "failed to write verified napplet artifacts after prune retry",
-          cause: cause ?? firstCause
+    const out = /* @__PURE__ */ new Map();
+    for (const pubkey2 of uniquePubkeys) {
+      const entries = registry2.getRelayList(pubkey2);
+      if (entries) {
+        out.set(pubkey2, {
+          read: selectReadRelays(entries),
+          write: selectWriteRelays(entries)
         });
       }
     }
-  }
-  async writeCoordinate(input) {
-    const cache2 = await this.open();
-    const now2 = this.now();
-    const index = await this.readIndex(cache2);
-    const key = coordinateKey(input.kind, input.pubkey, input.dTag);
-    index.coordinates[key] = {
-      key,
-      kind: input.kind,
-      pubkey: input.pubkey,
-      dTag: input.dTag,
-      aggregateHash: input.aggregateHash,
-      lastResolvedAt: input.lastResolvedAt ?? now2,
-      foregroundTtlMs: input.foregroundTtlMs ?? DEFAULT_FOREGROUND_TTL_MS,
-      backgroundTtlMs: input.backgroundTtlMs ?? DEFAULT_BACKGROUND_TTL_MS
-    };
-    index.updatedAt = now2;
-    await this.writeIndex(cache2, index);
-  }
-  async getCoordinate(input, options = {}) {
-    const cache2 = await this.open();
-    const index = await this.readIndex(cache2);
-    const coordinate = index.coordinates[coordinateKey(input.kind, input.pubkey, input.dTag)];
-    if (!coordinate) return void 0;
-    return { ...coordinate, fresh: isCoordinateFresh(coordinate, options) };
-  }
-  async touchAggregate(dTag, aggregateHash, now2 = this.now()) {
-    const cache2 = await this.open();
-    const index = await this.readIndex(cache2);
-    const key = aggregateKey(dTag, aggregateHash);
-    const aggregate = index.aggregates[key];
-    if (!aggregate) return;
-    aggregate.lastAccessed = now2;
-    for (const hash of aggregate.blobHashes) {
-      if (index.blobs[hash]) index.blobs[hash].lastAccessed = now2;
+    return out;
+  };
+}
+function createPajaOutboxRelayPool(backend) {
+  return {
+    subscribe(filters, relayUrls2, callback) {
+      return backend.subscription(relayUrls2, filters).subscribe((item) => callback(item));
+    },
+    publish(event, relayUrls2) {
+      return backend.publishToRelays(relayUrls2, event);
+    },
+    isAvailable() {
+      return backend.isAvailable();
     }
-    index.updatedAt = now2;
-    await this.writeIndex(cache2, index);
-  }
-  markAggregateActive(dTag, aggregateHash) {
-    this.activeAggregates.add(aggregateKey(dTag, aggregateHash));
-  }
-  releaseAggregateActive(dTag, aggregateHash) {
-    this.activeAggregates.delete(aggregateKey(dTag, aggregateHash));
+  };
+}
+
+// src/browser-social-cache.ts
+var HEX_PUBKEY = /^[0-9a-f]{64}$/i;
+var FOLLOW_PARSE_YIELD_EVERY = 64;
+var PROFILE_WARM_YIELD_EVERY = 64;
+function createPajaSocialCache(options) {
+  let generation = 0;
+  let activeRefreshController;
+  const snapshots = /* @__PURE__ */ new Map();
+  async function loadFollows(capturedPubkey) {
+    const normalizedPubkey = normalizePubkey2(capturedPubkey);
+    if (!normalizedPubkey) return [];
+    const existing = snapshots.get(normalizedPubkey);
+    if (existing) return [...existing.follows];
+    const capturedGeneration = generation;
+    const follows = await verifiedFollows(normalizedPubkey);
+    const warmed = snapshots.get(normalizedPubkey);
+    if (warmed) return [...warmed.follows];
+    if (generation === capturedGeneration) {
+      snapshots.set(normalizedPubkey, { follows, profiles: /* @__PURE__ */ new Map() });
+    }
+    return [...follows];
   }
-  async prune(now2 = this.now()) {
-    try {
-      const cache2 = await this.open();
-      const index = await this.readIndex(cache2);
-      let size = cachedSize(index);
-      const budget = await this.budgetBytes();
-      const hardBudget = await this.hardBudgetBytes();
-      const shouldPrune = size > budget || await this.originPressureHigh();
-      if (!shouldPrune) return;
-      this.rewriteRefCounts(index);
-      for (const [hash, blob] of Object.entries(index.blobs)) {
-        if (size <= budget) break;
-        if (blob.refCount > 0) continue;
-        await cache2.delete(this.blobUrl(hash));
-        delete index.blobs[hash];
-        size -= blob.size;
-      }
-      const currentAggregateHashes = new Set(
-        Object.values(index.coordinates).map((coordinate) => coordinate.aggregateHash)
-      );
-      const aggregates = Object.values(index.aggregates).filter((entry) => !this.activeAggregates.has(entry.key)).sort((a, b) => {
-        const currentA = currentAggregateHashes.has(a.aggregateHash) ? 1 : 0;
-        const currentB = currentAggregateHashes.has(b.aggregateHash) ? 1 : 0;
-        if (currentA !== currentB) return currentA - currentB;
-        return a.lastAccessed - b.lastAccessed;
-      });
-      for (const aggregate of aggregates) {
-        if (size <= budget) break;
-        await cache2.delete(this.aggregateUrl(aggregate.key));
-        delete index.aggregates[aggregate.key];
-        size -= aggregate.size;
-        this.rewriteRefCounts(index);
+  async function verifiedFollows(capturedPubkey, isStillCurrent, signal) {
+    const candidates = await options.loadContactList(capturedPubkey, signal);
+    const verified = [];
+    for (const candidate of candidates) {
+      if (isStillCurrent && !isStillCurrent()) return [];
+      if (!isContactCandidate(candidate, capturedPubkey)) continue;
+      try {
+        if (await options.verifyEvent(candidate)) verified.push(candidate);
+      } catch {
       }
-      if (size > hardBudget) {
-        const active = Object.values(index.aggregates).filter((entry) => this.activeAggregates.has(entry.key)).sort((a, b) => a.lastAccessed - b.lastAccessed);
-        for (const aggregate of active) {
-          if (size <= hardBudget) break;
-          await cache2.delete(this.aggregateUrl(aggregate.key));
-          delete index.aggregates[aggregate.key];
-          size -= aggregate.size;
+    }
+    return contactPubkeys(selectReplacement(verified), isStillCurrent);
+  }
+  async function refreshActiveIdentity() {
+    activeRefreshController?.abort();
+    activeRefreshController = void 0;
+    const currentGeneration = ++generation;
+    const capturedPubkey = normalizePubkey2(options.getActivePubkey() ?? "");
+    if (!capturedPubkey) return;
+    const controller = new AbortController();
+    activeRefreshController = controller;
+    const isStillCurrent = () => !controller.signal.aborted && isCurrent(capturedPubkey, currentGeneration);
+    try {
+      const follows = await verifiedFollows(capturedPubkey, isStillCurrent, controller.signal);
+      if (!isStillCurrent()) return;
+      const snapshot = { follows, profiles: /* @__PURE__ */ new Map() };
+      snapshots.set(capturedPubkey, snapshot);
+      for (let index = 0; index < follows.length; index += 1) {
+        if (!isStillCurrent()) return;
+        const author = follows[index];
+        let warmed;
+        try {
+          warmed = await options.baseRouter.query(
+            [{ kinds: [0], authors: [author], limit: 1 }],
+            { authors: [author], limit: 1 }
+          );
+        } catch {
         }
-      }
-      this.rewriteRefCounts(index);
-      for (const [hash, blob] of Object.entries(index.blobs)) {
-        if (blob.refCount === 0) {
-          await cache2.delete(this.blobUrl(hash));
-          delete index.blobs[hash];
+        if (!isStillCurrent()) return;
+        if (warmed) {
+          const profile = profileResult(warmed, author);
+          if (profile) snapshot.profiles.set(author, profile);
+        }
+        if ((index + 1) % PROFILE_WARM_YIELD_EVERY === 0 && index + 1 < follows.length) {
+          if (!isStillCurrent()) return;
+          await yieldToEventLoop();
+          if (!isStillCurrent()) return;
         }
       }
-      index.updatedAt = now2;
-      await this.writeIndex(cache2, index);
-    } catch (cause) {
-      this.diagnostic({ type: "cache-prune-failed", message: "failed to prune napplet artifact cache", cause });
+    } catch {
+    } finally {
+      if (activeRefreshController === controller) activeRefreshController = void 0;
     }
   }
-  async snapshotIndex() {
-    return this.readIndex(await this.open());
+  function isCurrent(capturedPubkey, currentGeneration) {
+    return generation === currentGeneration && normalizePubkey2(options.getActivePubkey() ?? "") === capturedPubkey;
   }
-  async writeVerifiedResolutionOnce(input) {
-    const cache2 = await this.open();
-    const now2 = input.now ?? this.now();
-    const index = await this.readIndex(cache2);
-    const blobHashes = [];
-    for (const pathEntry of input.manifest.paths) {
-      const bytes = input.files.get(pathEntry.path);
-      if (!bytes) continue;
-      blobHashes.push(pathEntry.sha256);
-      await cache2.put(this.blobUrl(pathEntry.sha256), new Response(responseBody(bytes)));
-      index.blobs[pathEntry.sha256] = {
-        size: byteLength2(bytes),
-        lastAccessed: now2,
-        refCount: index.blobs[pathEntry.sha256]?.refCount ?? 0
-      };
-    }
-    const key = aggregateKey(input.manifest.dTag, input.manifest.aggregateHash);
-    const record = {
-      schemaVersion: SCHEMA_VERSION,
-      dTag: input.manifest.dTag,
-      aggregateHash: input.manifest.aggregateHash,
-      manifest: {
-        kind: input.manifest.kind,
-        pubkey: input.manifest.pubkey,
-        dTag: input.manifest.dTag,
-        paths: input.manifest.paths.map((entry) => ({ path: entry.path, sha256: entry.sha256 })),
-        requires: [...input.manifest.requires],
-        ...input.manifest.title === void 0 ? {} : { title: input.manifest.title },
-        ...input.manifest.description === void 0 ? {} : { description: input.manifest.description }
+  function decorate(router, canReadIdentity) {
+    return {
+      ...router.getEvent ? { getEvent: router.getEvent.bind(router) } : {},
+      async query(filters, queryOptions) {
+        const canAugmentAtStart = canReadIdentity?.() ?? true;
+        const activePubkey = normalizePubkey2(options.getActivePubkey() ?? "");
+        const snapshot = canAugmentAtStart && activePubkey ? snapshots.get(activePubkey) : void 0;
+        const base = await router.query(filters, queryOptions);
+        if (!canAugmentAtStart || !(canReadIdentity?.() ?? true)) return base;
+        const cached = matchingCachedProfiles(snapshot?.profiles, filters);
+        return mergeResult(base, cached, filters, queryOptions);
       },
-      indexHtml: input.indexHtml,
-      blobHashes,
-      writtenAt: now2
-    };
-    const aggregateBytes = new TextEncoder().encode(JSON.stringify(record));
-    await cache2.put(this.aggregateUrl(key), new Response(responseBody(aggregateBytes), {
-      headers: { "content-type": "application/json" }
-    }));
-    const coordKey = coordinateKey(input.manifest.kind, input.manifest.pubkey, input.manifest.dTag);
-    index.aggregates[key] = {
-      dTag: input.manifest.dTag,
-      aggregateHash: input.manifest.aggregateHash,
-      key,
-      blobHashes,
-      size: byteLength2(aggregateBytes),
-      lastAccessed: now2,
-      coordinateKey: coordKey
-    };
-    index.coordinates[coordKey] = {
-      key: coordKey,
-      kind: input.manifest.kind,
-      pubkey: input.manifest.pubkey,
-      dTag: input.manifest.dTag,
-      aggregateHash: input.manifest.aggregateHash,
-      lastResolvedAt: now2,
-      foregroundTtlMs: DEFAULT_FOREGROUND_TTL_MS,
-      backgroundTtlMs: DEFAULT_BACKGROUND_TTL_MS
+      subscribe: router.subscribe.bind(router),
+      publish: router.publish.bind(router),
+      resolveRelays: router.resolveRelays.bind(router)
     };
-    this.rewriteRefCounts(index);
-    index.updatedAt = now2;
-    await this.writeIndex(cache2, index);
-    await this.prune(now2);
-  }
-  async open() {
-    this.cachePromise ??= this.cacheStorage.open(this.cacheName);
-    return this.cachePromise;
   }
-  indexUrl() {
-    return new URL("__kehto_napplet_cache/index.json", this.baseUrl).toString();
-  }
-  blobUrl(hash) {
-    return new URL(`__kehto_napplet_cache/blob/${encodeKeyPart(hash)}`, this.baseUrl).toString();
-  }
-  aggregateUrl(key) {
-    return new URL(`__kehto_napplet_cache/aggregate/${encodeKeyPart(key)}.json`, this.baseUrl).toString();
-  }
-  async readIndex(cache2) {
-    const response = await cache2.match(this.indexUrl());
-    if (!response) return emptyIndex(this.now());
-    try {
-      const index = await responseJson(response);
-      if (index.schemaVersion !== SCHEMA_VERSION) return emptyIndex(this.now());
-      return index;
-    } catch {
-      return emptyIndex(this.now());
+  const unsubscribe = options.subscribeSignerChange?.(() => {
+    void refreshActiveIdentity();
+  });
+  return {
+    getFollows: loadFollows,
+    refreshActiveIdentity,
+    decorate,
+    dispose: () => {
+      activeRefreshController?.abort();
+      unsubscribe?.();
     }
-  }
-  async writeIndex(cache2, index) {
-    await cache2.put(this.indexUrl(), new Response(JSON.stringify(index), {
-      headers: { "content-type": "application/json" }
-    }));
-  }
-  rewriteRefCounts(index) {
-    const counts = refCounts(index);
-    for (const [hash, blob] of Object.entries(index.blobs)) {
-      blob.refCount = counts[hash] ?? 0;
+  };
+}
+function normalizePubkey2(value) {
+  return typeof value === "string" && HEX_PUBKEY.test(value) ? value.toLowerCase() : null;
+}
+function isContactCandidate(candidate, capturedPubkey) {
+  if (typeof candidate !== "object" || candidate === null) return false;
+  const event = candidate;
+  return event.kind === 3 && normalizePubkey2(event.pubkey) === capturedPubkey;
+}
+function selectReplacement(events) {
+  return [...events].sort((left, right) => {
+    const timestampOrder = right.created_at - left.created_at;
+    if (timestampOrder !== 0) return timestampOrder;
+    if (left.id === right.id) return 0;
+    return left.id < right.id ? -1 : 1;
+  })[0];
+}
+async function contactPubkeys(event, isStillCurrent) {
+  if (!event || !Array.isArray(event.tags)) return [];
+  const follows = /* @__PURE__ */ new Set();
+  for (let index = 0; index < event.tags.length; index += 1) {
+    if (isStillCurrent && !isStillCurrent()) return [];
+    const tag = event.tags[index];
+    if (Array.isArray(tag) && tag[0] === "p") {
+      const pubkey2 = normalizePubkey2(tag[1]);
+      if (pubkey2) follows.add(pubkey2);
     }
-  }
-  async budgetBytes() {
-    const estimate = await this.estimateStorage();
-    if (!estimate?.quota) return this.unknownBudgetBytes;
-    return Math.min(this.softCeilingBytes, Math.floor(estimate.quota * 0.1));
-  }
-  async hardBudgetBytes() {
-    const estimate = await this.estimateStorage();
-    if (!estimate?.quota) return this.unknownBudgetBytes;
-    return Math.min(this.hardCeilingBytes, Math.floor(estimate.quota * 0.2));
-  }
-  async originPressureHigh() {
-    const estimate = await this.estimateStorage();
-    if (!estimate?.quota || estimate.usage === void 0) return false;
-    return estimate.usage / estimate.quota >= 0.8;
-  }
-  async estimateStorage() {
-    if (!this.storage?.estimate) return void 0;
-    try {
-      return this.storage.estimate();
-    } catch (cause) {
-      this.diagnostic({
-        type: "storage-estimate-unavailable",
-        message: "storage estimate failed; using unknown quota cache budget",
-        cause
-      });
-      return void 0;
+    if ((index + 1) % FOLLOW_PARSE_YIELD_EVERY === 0 && index + 1 < event.tags.length) {
+      await yieldToEventLoop();
+      if (isStillCurrent && !isStillCurrent()) return [];
     }
   }
-  diagnostic(diagnostic) {
-    this.onDiagnostic?.(diagnostic);
-  }
-};
-async function openNappletArtifactCache(options = {}) {
-  const cacheStorage = options.cacheStorage ?? globalThis.caches;
-  if (!cacheStorage) return void 0;
-  const storage = options.storage ?? globalThis.navigator?.storage;
-  if (options.requireStorageEstimate && !storage?.estimate) {
-    options.onDiagnostic?.({
-      type: "storage-estimate-unavailable",
-      message: "storage estimates are unavailable; using network-only loading"
-    });
-    return void 0;
+  return [...follows];
+}
+function profileResult(result2, author) {
+  let newest;
+  for (const entry of result2.events) {
+    if (entry.event.kind !== 0 || normalizePubkey2(entry.event.pubkey) !== author) continue;
+    if (!newest || isNewerProfile(entry, newest)) newest = entry;
   }
-  try {
-    const cache2 = new CacheStorageNappletArtifactCache({ ...options, cacheStorage, storage });
-    await cache2.snapshotIndex();
-    return cache2;
-  } catch (cause) {
-    options.onDiagnostic?.({
-      type: "cache-open-failed",
-      message: "Cache Storage napplet artifact cache could not be opened",
-      cause
-    });
-    return void 0;
+  return newest;
+}
+function isNewerProfile(candidate, existing) {
+  if (candidate.event.created_at !== existing.event.created_at) {
+    return candidate.event.created_at > existing.event.created_at;
   }
+  return candidate.event.id < existing.event.id;
 }
-var NAPPLET_KIND_SNAPSHOT = 5129;
-var NAPPLET_KIND_ROOT = 15129;
-var NAPPLET_KIND_NAMED = 35129;
-var NAPPLET_KINDS = [
-  NAPPLET_KIND_SNAPSHOT,
-  NAPPLET_KIND_ROOT,
-  NAPPLET_KIND_NAMED
-];
-function isNappletManifestKind(kind) {
-  return NAPPLET_KINDS.includes(kind);
+function yieldToEventLoop() {
+  return new Promise((resolve) => setTimeout(resolve, 0));
 }
-var NappletResolutionError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "NappletResolutionError";
-    this.code = code;
+function matchingCachedProfiles(profiles, filters) {
+  const readyProfiles = profiles ? [...profiles.values()] : [];
+  if (filters.length === 0) return readyProfiles;
+  const matched = /* @__PURE__ */ new Map();
+  for (const filter of filters) {
+    const limit = typeof filter.limit === "number" && filter.limit >= 0 ? filter.limit : void 0;
+    let count = 0;
+    for (const entry of readyProfiles) {
+      if (!matchesAnyFilter2(entry.event, [filter])) continue;
+      if (limit !== void 0 && count >= limit) continue;
+      count += 1;
+      if (!matched.has(entry.event.id)) matched.set(entry.event.id, entry);
+    }
   }
-};
-function firstTagValue(tags, name) {
-  for (const tag of tags) {
-    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) return tag[1];
+  return [...matched.values()];
+}
+function mergeResult(base, cached, filters, queryOptions) {
+  const events = /* @__PURE__ */ new Map();
+  for (const entry of base.events) events.set(entry.event.id, entry);
+  for (const entry of cached) {
+    if (!events.has(entry.event.id)) events.set(entry.event.id, entry);
   }
-  return void 0;
+  return {
+    events: applyFinalLimits([...events.values()], filters, queryOptions),
+    ...base.incomplete === void 0 ? {} : { incomplete: base.incomplete },
+    ...base.error === void 0 ? {} : { error: base.error }
+  };
 }
-function allTagValues(tags, name) {
-  const out = [];
-  for (const tag of tags) {
-    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) out.push(tag[1]);
+function applyFinalLimits(entries, filters, queryOptions) {
+  const aggregateLimit = typeof queryOptions?.limit === "number" && queryOptions.limit >= 0 ? queryOptions.limit : void 0;
+  const aggregateCapped = aggregateLimit === void 0 ? entries : entries.slice(0, aggregateLimit);
+  if (filters.length === 0) return aggregateCapped;
+  const counts = filters.map(() => 0);
+  return aggregateCapped.filter((entry) => {
+    const matching = filters.flatMap((filter, index) => matchesAnyFilter2(entry.event, [filter]) ? [index] : []);
+    const allowed2 = matching.some((index) => {
+      const limit = filters[index]?.limit;
+      return typeof limit !== "number" || limit < 0 || counts[index] < limit;
+    });
+    if (!allowed2) return false;
+    for (const index of matching) counts[index] += 1;
+    return true;
+  });
+}
+
+// src/browser-relay-policy.ts
+var PAJA_STORAGE_PROBE_KEY = "kehto:paja:storage-probe";
+function normalizeRelayUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "wss:" && url.protocol !== "ws:" || url.username || url.password) return null;
+    url.hash = "";
+    return url.href;
+  } catch {
+    return null;
   }
-  return out;
 }
-function archetypesFromTags(tags) {
-  const out = [];
-  for (const tag of tags) {
-    if (tag[0] !== "archetype") continue;
-    const slug = tag[1];
-    if (typeof slug !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
-      throw new NappletResolutionError(
-        "invalid-manifest",
-        "archetype slug must contain lowercase letters, numbers, and hyphens"
-      );
-    }
-    const convention = tag[2];
-    if (typeof convention !== "string" || convention.length === 0) {
-      throw new NappletResolutionError("invalid-manifest", "archetype convention is required");
-    }
-    if (/^NAP-\d+$/.test(convention)) {
-      throw new NappletResolutionError(
-        "invalid-manifest",
-        "numbered NAP identifier is not an archetype convention"
-      );
-    }
-    if (!/^napplet:[^/?#\s]+\/[^/?#\s]+$/.test(convention)) {
-      throw new NappletResolutionError(
-        "invalid-manifest",
-        "archetype convention must be a queryless napplet:<archetype>/<intent> identity"
-      );
-    }
-    if (tag.length !== 3) {
-      throw new NappletResolutionError(
-        "invalid-manifest",
-        "archetype tags must contain exactly slug and convention"
-      );
-    }
-    out.push({ slug, convention });
+function isVerifiedNostrEvent(value) {
+  if (typeof value !== "object" || value === null) return false;
+  try {
+    return verifyEvent(value);
+  } catch {
+    return false;
   }
-  return out;
 }
-function parseNappletManifest(event) {
-  if (!isNappletManifestKind(event.kind)) {
-    throw new NappletResolutionError("invalid-manifest", `not a NIP-5D napplet kind: ${event.kind}`);
+function isPajaRelayAllowed(value, getConfiguredRelays) {
+  const normalized = normalizeRelayUrl(value);
+  if (!normalized) return false;
+  if (getConfiguredRelays().some((url2) => normalizeRelayUrl(url2) === normalized)) return true;
+  const url = new URL(normalized);
+  if (url.protocol !== "wss:") return false;
+  const hostname = url.hostname.replace(/^\[|\]$/gu, "").toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || !hostname.includes(".")) return false;
+  if (hostname.includes(":")) {
+    return hostname !== "::" && hostname !== "::1" && !/^(?:fc|fd|fe[89ab])/iu.test(hostname);
   }
-  const paths = pathEntriesFromTags(event.tags);
-  if (paths.length === 0) {
-    throw new NappletResolutionError("invalid-manifest", "manifest has no path tags");
+  const octets = hostname.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return true;
+  const [first, second] = octets;
+  return first !== 0 && first !== 10 && first !== 127 && first < 224 && !(first === 100 && second >= 64 && second <= 127) && !(first === 169 && second === 254) && !(first === 172 && second >= 16 && second <= 31) && !(first === 192 && second === 168) && !(first === 198 && (second === 18 || second === 19));
+}
+function createPajaRelayConfig(getSimulation) {
+  const tierNames = ["discovery", "super", "outbox"];
+  const additions = /* @__PURE__ */ new Map();
+  const removals = /* @__PURE__ */ new Map();
+  const current = { discovery: [], super: [], outbox: [] };
+  const allRelays = [];
+  function isTier(value) {
+    return tierNames.includes(value);
   }
-  const aggregateHash = aggregateTagValue(event.tags);
-  if (!aggregateHash) {
-    throw new NappletResolutionError("invalid-manifest", "manifest has no aggregate x tag");
+  function refresh() {
+    for (const tier of tierNames) {
+      const seen = /* @__PURE__ */ new Set();
+      const values = [];
+      const removed = removals.get(tier);
+      for (const url of [...getPajaRelayUrls(getSimulation()), ...additions.get(tier)?.values() ?? []]) {
+        const normalized = normalizeRelayUrl(url);
+        if (!normalized || seen.has(normalized) || removed?.has(normalized)) continue;
+        seen.add(normalized);
+        values.push(url);
+      }
+      current[tier].splice(0, current[tier].length, ...values);
+    }
+    const combined = [...new Set(tierNames.flatMap((tier) => current[tier]))];
+    allRelays.splice(0, allRelays.length, ...combined);
   }
-  const dTag = firstTagValue(event.tags, "d");
-  if (event.kind !== NAPPLET_KIND_NAMED && dTag !== void 0) {
-    throw new NappletResolutionError("invalid-manifest", "only named manifests may carry a d tag");
+  const runtime = {
+    allRelays,
+    outboxRelays: current.outbox,
+    addRelay(tier, url) {
+      const normalized = normalizeRelayUrl(url);
+      if (!isTier(tier) || !normalized) return;
+      const entries = additions.get(tier) ?? /* @__PURE__ */ new Map();
+      entries.set(normalized, url);
+      additions.set(tier, entries);
+      removals.get(tier)?.delete(normalized);
+      refresh();
+    },
+    removeRelay(tier, url) {
+      const normalized = normalizeRelayUrl(url);
+      if (!isTier(tier) || !normalized) return;
+      additions.get(tier)?.delete(normalized);
+      const entries = removals.get(tier) ?? /* @__PURE__ */ new Set();
+      entries.add(normalized);
+      removals.set(tier, entries);
+      refresh();
+    },
+    getRelayConfig() {
+      refresh();
+      return {
+        discovery: [...current.discovery],
+        super: [...current.super],
+        outbox: [...current.outbox]
+      };
+    },
+    getNip66Suggestions: () => [],
+    getRelayUrls(tiers = tierNames) {
+      refresh();
+      return [...new Set(tiers.flatMap((tier) => current[tier]))];
+    }
+  };
+  refresh();
+  return runtime;
+}
+function createPajaRelayHooks(pool, getSimulation, relayConfig) {
+  const cleanups = /* @__PURE__ */ new Map();
+  const scoped = /* @__PURE__ */ new Map();
+  function closeScopedRelay(windowId) {
+    scoped.get(windowId)?.unsubscribe();
+    scoped.delete(windowId);
   }
   return {
-    kind: event.kind,
-    pubkey: event.pubkey,
-    dTag: dTag ?? "",
-    paths,
-    aggregateHash,
-    servers: allTagValues(event.tags, "server"),
-    requires: allTagValues(event.tags, "requires"),
-    archetypes: archetypesFromTags(event.tags),
-    title: firstTagValue(event.tags, "title"),
-    description: firstTagValue(event.tags, "description"),
-    source: firstTagValue(event.tags, "source")
+    getRelayPool: () => pool,
+    trackSubscription(subKey, cleanup) {
+      cleanups.set(subKey, cleanup);
+    },
+    untrackSubscription(subKey) {
+      cleanups.get(subKey)?.();
+      cleanups.delete(subKey);
+    },
+    openScopedRelay(windowId, relayUrl2, subId, filters, sourceWindow) {
+      closeScopedRelay(windowId);
+      const configured = new Map(relayConfig.getRelayUrls().flatMap((url) => {
+        const normalized = normalizeRelayUrl(url);
+        return normalized ? [[normalized, url]] : [];
+      }));
+      const requested = normalizeRelayUrl(relayUrl2);
+      const allowedUrl = requested && isPajaRelayAllowed(relayUrl2, () => relayConfig.getRelayUrls()) ? configured.get(requested) ?? requested : void 0;
+      if (getSimulation().relay.mode !== "live" || !allowedUrl) {
+        sourceWindow.postMessage({ type: "relay.closed", subId, reason: "scoped relay unavailable" }, "*");
+        return;
+      }
+      const subscription = pool.subscription([allowedUrl], filters).subscribe((item) => {
+        if (item === "EOSE") {
+          sourceWindow.postMessage({ type: "relay.eose", subId }, "*");
+          return;
+        }
+        if (!isVerifiedNostrEvent(item)) return;
+        sourceWindow.postMessage({
+          type: "relay.event",
+          subId,
+          result: { event: item, sidecar: { relayHints: [allowedUrl] } }
+        }, "*");
+      });
+      scoped.set(windowId, { relayUrl: allowedUrl, unsubscribe: () => subscription.unsubscribe() });
+    },
+    closeScopedRelay,
+    publishToScopedRelay: async (windowId, event) => {
+      const active = scoped.get(windowId);
+      if (getSimulation().relay.mode !== "live" || !active || !verifyEvent(event)) return false;
+      try {
+        await pool.publish([active.relayUrl], event);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    selectRelayTier: () => relayConfig.getRelayUrls(["discovery", "super"])
   };
 }
-function verifyManifestSignature(event) {
+function hasWritableLocalStorage() {
+  if (typeof localStorage === "undefined") return false;
+  let previous = null;
   try {
-    return verifyEvent(event);
+    previous = localStorage.getItem(PAJA_STORAGE_PROBE_KEY);
+    localStorage.setItem(PAJA_STORAGE_PROBE_KEY, "1");
+    const available = localStorage.getItem(PAJA_STORAGE_PROBE_KEY) === "1";
+    if (previous === null) localStorage.removeItem(PAJA_STORAGE_PROBE_KEY);
+    else localStorage.setItem(PAJA_STORAGE_PROBE_KEY, previous);
+    return available;
   } catch {
+    try {
+      if (previous === null) localStorage.removeItem(PAJA_STORAGE_PROBE_KEY);
+      else localStorage.setItem(PAJA_STORAGE_PROBE_KEY, previous);
+    } catch {
+    }
     return false;
   }
 }
-function verifyBlobHash(bytes, sha256Hex) {
-  return bytesToHex2(sha256(bytes)) === sha256Hex;
-}
-function stripTrailingSlash(url) {
-  return url.endsWith("/") ? url.slice(0, -1) : url;
-}
-async function fetchBlob(servers, sha256Hex, fetchBytes) {
-  for (const server of servers) {
-    const url = `${stripTrailingSlash(server)}/${sha256Hex}`;
+
+// src/browser-common.ts
+var HEX_642 = /^[0-9a-f]{64}$/i;
+var SHORTCODE = /^:[a-zA-Z0-9_+-]+:$/;
+function relayUrls(values) {
+  const urls = /* @__PURE__ */ new Set();
+  for (const value of values) {
     try {
-      const bytes = await fetchBytes(url);
-      if (verifyBlobHash(bytes, sha256Hex)) return bytes;
+      const url = new URL(value);
+      if (url.protocol === "wss:" || url.protocol === "ws:") urls.add(url.href);
     } catch {
     }
   }
-  throw new NappletResolutionError("blob-unavailable", `no server served blob ${sha256Hex}`);
-}
-var INDEX_PATHS = ["/index.html", "index.html", "/"];
-function defaultDecode(bytes) {
-  return new TextDecoder().decode(bytes);
+  return [...urls];
 }
-async function resolveNapplet(options) {
-  const { event, fetchBlob: fetchBlobBytes, textDecode = defaultDecode, cache: cache2 } = options;
-  if (!verifyManifestSignature(event)) {
-    throw new NappletResolutionError("invalid-signature", "manifest signature is invalid");
-  }
-  const manifest = parseNappletManifest(event);
-  const recomputed = computeAggregateHash(manifest.paths);
-  if (recomputed !== manifest.aggregateHash) {
-    throw new NappletResolutionError(
-      "aggregate-mismatch",
-      `recomputed aggregate ${recomputed} != manifest ${manifest.aggregateHash}`
-    );
-  }
-  const files = /* @__PURE__ */ new Map();
-  for (const entry of manifest.paths) {
-    let bytes = await cache2?.readBlob(entry.sha256);
-    if (bytes && !verifyBlobHash(bytes, entry.sha256)) {
-      await cache2?.deleteBlob(entry.sha256);
-      bytes = void 0;
+function profileTarget(target, defaults) {
+  if (HEX_642.test(target)) return { pubkey: target.toLowerCase(), relays: relayUrls(defaults) };
+  try {
+    const decoded = decode(target);
+    if (decoded.type === "npub") {
+      return { pubkey: decoded.data.toLowerCase(), relays: relayUrls(defaults) };
     }
-    bytes ??= await fetchBlobBytes(entry.sha256, manifest.servers);
-    if (!verifyBlobHash(bytes, entry.sha256)) {
-      throw new NappletResolutionError(
-        "blob-hash-mismatch",
-        `blob for ${entry.path} does not match hash ${entry.sha256}`
-      );
+    if (decoded.type === "nprofile") {
+      return {
+        pubkey: decoded.data.pubkey.toLowerCase(),
+        relays: relayUrls([
+          ...(decoded.data.relays ?? []).filter((relay) => isPajaRelayAllowed(relay, () => defaults)),
+          ...defaults
+        ])
+      };
     }
-    files.set(entry.path, bytes);
+  } catch {
+    return null;
   }
-  const indexEntry = manifest.paths.find((e) => INDEX_PATHS.includes(e.path));
-  if (!indexEntry) {
-    throw new NappletResolutionError("missing-index", "manifest has no /index.html entry");
+  return null;
+}
+function npub(value) {
+  try {
+    const decoded = decode(value);
+    return decoded.type === "npub" ? decoded.data.toLowerCase() : null;
+  } catch {
+    return null;
   }
-  const indexHtml = textDecode(files.get(indexEntry.path));
-  await cache2?.writeVerifiedResolution({ event, manifest, files, indexHtml });
-  return {
-    dTag: manifest.dTag,
-    aggregateHash: manifest.aggregateHash,
-    files,
-    indexHtml,
-    manifest
-  };
 }
-
-// src/browser-resource.ts
-var PAJA_RESOURCE_MAX_BYTES = 10 * 1024 * 1024;
-var PAJA_RESOURCE_MAX_URLS = 100;
-var UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
-var BLOSSOM_RESOURCE_PATTERN = /^blossom:sha256:([0-9a-f]{64})$/i;
-function createPajaResourceFetch(options = {}) {
-  return async (value, init) => {
-    if (init.signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
-    const url = new URL(value);
-    if (init.method && init.method.toUpperCase() !== "GET") {
-      throw new ResourceServiceError("invalid-request", "NAP-RESOURCE is read-only");
-    }
-    if (url.protocol === "blossom:") {
-      return fetchBlossomResource(value, init.signal, options);
-    }
-    if (url.protocol === "http:" || url.protocol === "https:") {
-      return fetchNetworkResource(value, init.signal, options.fetch ?? globalThis.fetch);
-    }
-    if (url.protocol !== "data:") {
-      throw new ResourceServiceError("unsupported-scheme", `Paja does not enable ${url.protocol}`);
-    }
-    if (value.length > encodedDataUrlLimit(PAJA_RESOURCE_MAX_BYTES)) {
-      throw new ResourceServiceError("too-large", `resource exceeds ${PAJA_RESOURCE_MAX_BYTES} bytes`);
-    }
-    const decoded = await fetch(value, { signal: init.signal });
-    const bytes = new Uint8Array(await decoded.arrayBuffer());
-    if (bytes.byteLength > PAJA_RESOURCE_MAX_BYTES) {
-      throw new ResourceServiceError("too-large", `resource exceeds ${PAJA_RESOURCE_MAX_BYTES} bytes`);
-    }
-    const mime = sniffSafeResourceMime(bytes);
-    if (!mime) {
-      throw new ResourceServiceError("decode-failed", "resource bytes are not an enabled safe media type");
-    }
-    return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
-  };
+function pubkey(value) {
+  if (HEX_642.test(value)) return value.toLowerCase();
+  return npub(value);
 }
-function pajaResourceInfo(blossomServers = []) {
-  const schemes = [
-    { scheme: "data", enabled: true },
-    { scheme: "https", enabled: true },
-    { scheme: "http", enabled: true }
-  ];
-  if (usableBlossomServers(blossomServers).length > 0) {
-    schemes.push({ scheme: "blossom", enabled: true });
-  }
-  return {
-    schemes,
-    maxBytes: PAJA_RESOURCE_MAX_BYTES,
-    maxUrls: PAJA_RESOURCE_MAX_URLS
-  };
+function newestVerified(events, predicate) {
+  return events.filter((event) => predicate(event) && verifyEvent(event)).sort((left, right) => right.created_at - left.created_at || left.id.localeCompare(right.id))[0] ?? null;
 }
-async function fetchNetworkResource(value, signal, fetcher) {
-  let response;
+function parseProfile(event) {
   try {
-    response = await fetcher(value, {
-      method: "GET",
-      signal,
-      credentials: "omit",
-      referrerPolicy: "no-referrer"
-    });
-  } catch (error) {
-    if (signal.aborted || isAbortError(error)) throw error;
-    throw new ResourceServiceError(
-      "network-error",
-      error instanceof Error ? error.message : String(error)
-    );
-  }
-  if (response.status === 404 || response.status === 410) {
-    throw new ResourceServiceError("not-found", "HTTP resource was not found");
-  }
-  if (!response.ok) {
-    throw new ResourceServiceError("network-error", `HTTP resource returned ${response.status}`);
-  }
-  const bytes = await readCappedResponse(response, signal);
-  const mime = sniffSafeResourceMime(bytes);
-  if (!mime) {
-    throw new ResourceServiceError("decode-failed", "resource bytes are not an enabled safe media type");
+    const parsed = JSON.parse(event.content);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+    const profile = { ...parsed };
+    if (typeof profile.display_name === "string" && typeof profile.displayName !== "string") {
+      profile.displayName = profile.display_name;
+    }
+    return profile;
+  } catch {
+    return null;
   }
-  return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
 }
-async function fetchBlossomResource(value, signal, options) {
-  const match = BLOSSOM_RESOURCE_PATTERN.exec(value);
-  if (!match?.[1]) {
-    throw new ResourceServiceError("invalid-request", "expected blossom:sha256:<64 hex characters>");
+function contactPubkeys2(event) {
+  const follows = /* @__PURE__ */ new Set();
+  for (const tag of event?.tags ?? []) {
+    if (tag[0] === "p" && typeof tag[1] === "string" && HEX_642.test(tag[1])) {
+      follows.add(tag[1].toLowerCase());
+    }
   }
-  const expectedHash = match[1].toLowerCase();
-  const servers = usableBlossomServers(options.getBlossomServers?.() ?? []);
-  if (servers.length === 0) {
-    throw new ResourceServiceError("blocked-by-policy", "Paja has no configured Blossom server");
+  return [...follows];
+}
+function actionError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (message.includes("denied")) return { ok: false, error: "user-denied" };
+  if (message.includes("publish")) return { ok: false, error: "publish-failed" };
+  return { ok: false, error: message };
+}
+function isSingleEmoji(value) {
+  const graphemes = [...new Intl.Segmenter(void 0, { granularity: "grapheme" }).segment(value)];
+  return graphemes.length === 1 && /[\p{Extended_Pictographic}\p{Regional_Indicator}]/u.test(value);
+}
+function reactionTags(target, reaction, customEmojiHref) {
+  if (reaction !== "+" && reaction !== "-" && !isSingleEmoji(reaction) && !SHORTCODE.test(reaction)) return null;
+  if (customEmojiHref && !SHORTCODE.test(reaction)) return null;
+  if (SHORTCODE.test(reaction) && !customEmojiHref) return null;
+  const tags = [["e", target.id], ["p", target.pubkey], ["k", String(target.kind)]];
+  if (customEmojiHref) {
+    let url;
+    try {
+      url = new URL(customEmojiHref);
+    } catch {
+      return null;
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    tags.push(["emoji", reaction.slice(1, -1), url.href]);
   }
-  const fetcher = options.fetch ?? globalThis.fetch;
-  let foundHashMismatch = false;
-  let foundNotFound = false;
-  let lastNetworkMessage = "all configured Blossom servers failed";
-  for (const server of servers) {
-    if (signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
-    const resourceUrl = `${server}/${expectedHash}`;
-    let response;
+  return tags;
+}
+function createPajaCommonBackend(options) {
+  const query = (filters, relays = options.getRelays()) => options.relay.query(relays, filters, PAJA_LIVE_QUERY_WAIT_MS);
+  const identity = async () => {
+    const active = options.getSigner();
+    if (!active?.getPublicKey) throw new Error("not-signed-in");
+    const activePubkey = (await active.getPublicKey()).toLowerCase();
+    if (!HEX_642.test(activePubkey)) throw new Error("not-signed-in");
+    return { signer: active, pubkey: activePubkey };
+  };
+  const signer = async () => {
+    const active = await identity();
+    if (!active.signer.signEvent) throw new Error("not-signed-in");
+    return active;
+  };
+  const currentContacts = async (author) => {
+    const events = await query([{ kinds: [3], authors: [author], limit: 16 }]);
+    return newestVerified(events, (event) => event.kind === 3 && event.pubkey.toLowerCase() === author);
+  };
+  const publish = async (active, author, template) => {
     try {
-      response = await fetcher(resourceUrl, {
-        method: "GET",
-        signal,
-        redirect: "error",
-        cache: "no-store"
-      });
+      const event = await active.signEvent(template);
+      if (event.pubkey.toLowerCase() !== author || !verifyEvent(event)) return { ok: false, error: "invalid-signature" };
+      await options.relay.publish(options.getRelays(), event);
+      return { ok: true, eventId: event.id, event };
     } catch (error) {
-      if (signal.aborted || isAbortError(error)) throw error;
-      lastNetworkMessage = error instanceof Error ? error.message : String(error);
-      continue;
-    }
-    if (response.status === 404 || response.status === 410) {
-      foundNotFound = true;
-      continue;
-    }
-    if (!response.ok) {
-      lastNetworkMessage = `Blossom server returned HTTP ${response.status}`;
-      continue;
+      return actionError(error);
     }
-    const bytes = await readCappedResponse(response, signal);
-    if (!verifyBlobHash(bytes, expectedHash)) {
-      foundHashMismatch = true;
-      continue;
+  };
+  const mutateFollows = async (values, add) => {
+    const targets = values.map(pubkey);
+    if (targets.some((target) => target === null)) return { ok: false, error: "invalid-pubkey" };
+    try {
+      const active = await signer();
+      const current = await currentContacts(active.pubkey);
+      const targetSet = new Set(targets);
+      const existing = new Set(contactPubkeys2(current));
+      const changed = add ? [...targetSet].some((target) => !existing.has(target)) : [...targetSet].some((target) => existing.has(target));
+      if (!changed) {
+        return current ? { ok: true, eventId: current.id, event: current } : { ok: true };
+      }
+      const tags = (current?.tags ?? []).filter((tag) => {
+        if (tag[0] !== "p" || typeof tag[1] !== "string") return true;
+        return add || !targetSet.has(tag[1].toLowerCase());
+      });
+      if (add) {
+        for (const target of targetSet) {
+          if (!existing.has(target)) tags.push(["p", target]);
+        }
+      }
+      return publish(active.signer, active.pubkey, {
+        kind: 3,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags,
+        content: current?.content ?? ""
+      });
+    } catch (error) {
+      return actionError(error);
     }
-    const mime = sniffSafeResourceMime(bytes);
-    if (!mime) {
-      throw new ResourceServiceError("decode-failed", "resource bytes are not an enabled safe media type");
+  };
+  return {
+    async getProfile(target) {
+      const resolved = profileTarget(target, options.getRelays());
+      if (!resolved) return { ok: false, pubkey: "", error: "invalid-profile-target" };
+      try {
+        const events = await query([{ kinds: [0], authors: [resolved.pubkey], limit: 16 }], resolved.relays);
+        const event = newestVerified(events, (candidate) => candidate.kind === 0 && candidate.pubkey.toLowerCase() === resolved.pubkey);
+        if (!event) return { ok: true, pubkey: resolved.pubkey, profile: null };
+        return {
+          ok: true,
+          pubkey: resolved.pubkey,
+          profile: parseProfile(event),
+          result: { event, sidecar: { relayHints: resolved.relays } }
+        };
+      } catch {
+        return { ok: false, pubkey: resolved.pubkey, error: "relay-timeout" };
+      }
+    },
+    async follows() {
+      try {
+        const active = await identity();
+        return { ok: true, pubkeys: contactPubkeys2(await currentContacts(active.pubkey)) };
+      } catch (error) {
+        const failure3 = actionError(error);
+        return { ok: false, pubkeys: [], error: failure3.error };
+      }
+    },
+    follow: (pubkeys) => mutateFollows(pubkeys, true),
+    unfollow: (pubkeys) => mutateFollows(pubkeys, false),
+    async react(targetEventId, reaction, customEmojiHref) {
+      if (!HEX_642.test(targetEventId)) return { ok: false, error: "invalid-target" };
+      try {
+        const active = await signer();
+        const events = await query([{ ids: [targetEventId], limit: 8 }]);
+        const target = newestVerified(events, (event) => event.id === targetEventId.toLowerCase());
+        if (!target) return { ok: false, error: "invalid-target" };
+        const tags = reactionTags(target, reaction, customEmojiHref);
+        if (!tags) return { ok: false, error: "invalid-reaction" };
+        return publish(active.signer, active.pubkey, {
+          kind: 7,
+          created_at: Math.floor(Date.now() / 1e3),
+          tags,
+          content: reaction
+        });
+      } catch (error) {
+        return actionError(error);
+      }
+    },
+    async report(target, reason, text) {
+      try {
+        const active = await signer();
+        if (target.type === "pubkey") {
+          const reportedPubkey = pubkey(target.pubkey);
+          if (!reportedPubkey) return { ok: false, error: "invalid-target" };
+          return publish(active.signer, active.pubkey, {
+            kind: 1984,
+            created_at: Math.floor(Date.now() / 1e3),
+            tags: [["p", reportedPubkey, target.relay ?? "", reason]],
+            content: text
+          });
+        }
+        if (!HEX_642.test(target.id)) return { ok: false, error: "invalid-target" };
+        const explicitAuthor = target.pubkey ? pubkey(target.pubkey) : void 0;
+        if (target.pubkey && !explicitAuthor) return { ok: false, error: "invalid-target" };
+        let author = explicitAuthor ?? null;
+        if (!author) {
+          const events = await query([{ ids: [target.id], limit: 8 }]);
+          author = newestVerified(events, (event) => event.id === target.id.toLowerCase())?.pubkey ?? null;
+        }
+        if (!author) return { ok: false, error: "author-unresolved" };
+        return publish(active.signer, active.pubkey, {
+          kind: 1984,
+          created_at: Math.floor(Date.now() / 1e3),
+          tags: [
+            ["e", target.id.toLowerCase(), target.relay ?? "", reason],
+            ["p", author.toLowerCase(), "", reason]
+          ],
+          content: text
+        });
+      } catch (error) {
+        return actionError(error);
+      }
     }
-    return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
-  }
-  if (foundHashMismatch) {
-    throw new ResourceServiceError("decode-failed", "Blossom response did not match the requested SHA-256");
-  }
-  if (foundNotFound) {
-    throw new ResourceServiceError("not-found", "Blossom resource was not found");
+  };
+}
+
+// src/browser-lists.ts
+var HEX_643 = /^[0-9a-f]{64}$/i;
+var ADDRESS = /^\d+:[0-9a-f]{64}:.+$/i;
+var SUPPORTED_LISTS = [
+  {
+    kind: 1e4,
+    type: "mute-list",
+    addressable: false,
+    supportedItemTypes: ["pubkey", "event", "hashtag", "word"],
+    privateItems: false,
+    tagByItemType: { pubkey: "p", event: "e", hashtag: "t", word: "word" }
+  },
+  {
+    kind: 10002,
+    type: "relay-list-metadata",
+    addressable: false,
+    supportedItemTypes: ["relay"],
+    privateItems: false,
+    tagByItemType: { relay: "r" }
+  },
+  {
+    kind: 10003,
+    type: "bookmarks",
+    addressable: false,
+    supportedItemTypes: ["event", "address"],
+    privateItems: false,
+    tagByItemType: { event: "e", address: "a" }
+  },
+  {
+    kind: 3e4,
+    type: "follow-sets",
+    addressable: true,
+    supportedItemTypes: ["pubkey"],
+    privateItems: false,
+    tagByItemType: { pubkey: "p" }
   }
-  throw new ResourceServiceError("network-error", lastNetworkMessage);
+];
+function publicSupport() {
+  return SUPPORTED_LISTS.map(({ tagByItemType: _tagByItemType, ...support }) => ({
+    ...support,
+    supportedItemTypes: support.supportedItemTypes ? [...support.supportedItemTypes] : void 0
+  }));
 }
-function usableBlossomServers(values) {
-  const servers = [];
-  for (const value of values) {
-    try {
-      const [server] = normalizeUploadServers([value]);
-      if (server && !servers.includes(server)) servers.push(server);
-    } catch {
-    }
+function failure2(error, reason) {
+  return { ok: false, error, reason, supported: publicSupport() };
+}
+function resolveList(ref) {
+  const input = ref;
+  const hasKind = typeof input.kind === "number";
+  const hasType = typeof input.type === "string" && input.type.length > 0;
+  if (hasKind === hasType) return failure2("invalid-list-ref", "exactly one list kind or type is required");
+  const candidates = hasKind ? SUPPORTED_LISTS.filter((support2) => support2.kind === input.kind) : SUPPORTED_LISTS.filter((support2) => support2.type === input.type);
+  if (candidates.length === 0) return failure2("unsupported-list", "list kind or type is not supported");
+  if (candidates.length > 1) return failure2("ambiguous-list", "list type maps to multiple supported kinds");
+  const support = candidates[0];
+  const identifier = typeof input.identifier === "string" && input.identifier.length > 0 ? input.identifier : void 0;
+  if (support.addressable && !identifier) return failure2("missing-identifier", "addressable lists require an identifier");
+  if (!support.addressable && identifier) return failure2("invalid-list-ref", "replaceable list does not accept an identifier");
+  return { support, ...identifier ? { identifier } : {} };
+}
+function relayUrl(value) {
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "ws:" || parsed.protocol === "wss:" ? parsed.href : null;
+  } catch {
+    return null;
   }
-  return servers;
 }
-async function readCappedResponse(response, signal) {
-  const declaredLength = Number(response.headers.get("content-length"));
-  if (Number.isFinite(declaredLength) && declaredLength > PAJA_RESOURCE_MAX_BYTES) {
-    throw resourceTooLarge();
+function itemTag(support, item) {
+  if (item.visibility === "private") return failure2("private-items-unsupported", "private list items require NIP-44 support");
+  const tagName = support.tagByItemType[item.itemType];
+  if (!tagName) return failure2("unsupported-item", `${item.itemType} is not supported by ${support.type}`);
+  const value = item.value.trim();
+  if (!value) return failure2("invalid-item", "list item value is empty");
+  if ((item.itemType === "pubkey" || item.itemType === "event") && !HEX_643.test(value)) {
+    return failure2("invalid-item", `${item.itemType} values must be 32-byte hex`);
   }
-  if (!response.body) {
-    const bytes2 = new Uint8Array(await response.arrayBuffer());
-    if (bytes2.byteLength > PAJA_RESOURCE_MAX_BYTES) throw resourceTooLarge();
-    return bytes2;
+  if (item.itemType === "address" && !ADDRESS.test(value)) {
+    return failure2("invalid-item", "address values must use kind:pubkey:identifier");
   }
-  const reader = response.body.getReader();
-  const chunks = [];
-  let total = 0;
-  try {
-    while (true) {
-      if (signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
-      const { done, value } = await reader.read();
-      if (done) break;
-      total += value.byteLength;
-      if (total > PAJA_RESOURCE_MAX_BYTES) {
-        await reader.cancel();
-        throw resourceTooLarge();
-      }
-      chunks.push(value);
+  if (support.kind === 10002) {
+    const url = relayUrl(value);
+    if (!url) return failure2("invalid-item", "relay list items require ws or wss URLs");
+    const marker = item.marker ?? "read-write";
+    if (marker !== "read" && marker !== "write" && marker !== "read-write") {
+      return failure2("invalid-item", "relay marker must be read, write, or read-write");
     }
-  } finally {
-    reader.releaseLock();
-  }
-  const bytes = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
+    return marker === "read-write" ? ["r", url] : ["r", url, marker];
   }
-  return bytes;
+  const tag = [tagName, value];
+  if (item.relay) tag.push(item.relay);
+  if (item.label) tag.push(item.label);
+  return tag;
 }
-function resourceTooLarge() {
-  return new ResourceServiceError("too-large", `resource exceeds ${PAJA_RESOURCE_MAX_BYTES} bytes`);
+function isFailure(value) {
+  return !Array.isArray(value);
 }
-function isAbortError(error) {
-  return error instanceof Error && (error.name === "AbortError" || error.name === "DOMException");
+function sameItem(tag, expected) {
+  if (tag[0] !== expected[0] || tag[1] !== expected[1]) return false;
+  if (expected.length > 2 && tag[2] !== expected[2]) return false;
+  if (expected.length > 3 && tag[3] !== expected[3]) return false;
+  return true;
 }
-function arrayBufferFor(bytes) {
-  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+function relayCoverage(tag) {
+  if (tag[2] === "read") return /* @__PURE__ */ new Set(["read"]);
+  if (tag[2] === "write") return /* @__PURE__ */ new Set(["write"]);
+  return /* @__PURE__ */ new Set(["read", "write"]);
 }
-function encodedDataUrlLimit(maxBytes) {
-  return Math.ceil(maxBytes * 4 / 3) + 1024;
+function relayTag(url, coverage) {
+  if (coverage.size === 0) return null;
+  if (coverage.size === 2) return ["r", url];
+  return ["r", url, coverage.has("read") ? "read" : "write"];
 }
-function startsWith(bytes, signature, offset = 0) {
-  return signature.every((value, index) => bytes[offset + index] === value);
+function sameRelay(tag, url) {
+  return tag[0] === "r" && typeof tag[1] === "string" && relayUrl(tag[1]) === url;
 }
-function ascii(bytes, start, end) {
-  return String.fromCharCode(...bytes.subarray(start, end));
+function addRelayItem(tags, expected) {
+  const url = expected[1];
+  const matching = tags.filter((tag) => sameRelay(tag, url));
+  const coverage = /* @__PURE__ */ new Set();
+  for (const tag of matching) for (const direction of relayCoverage(tag)) coverage.add(direction);
+  const requested = relayCoverage(expected);
+  const before = coverage.size;
+  for (const direction of requested) coverage.add(direction);
+  if (coverage.size === before) return { tags, changed: false };
+  const retained = tags.filter((tag) => !sameRelay(tag, url));
+  retained.push(relayTag(url, coverage));
+  return { tags: retained, changed: true };
 }
-function sniffSafeResourceMime(bytes) {
-  if (startsWith(bytes, [137, 80, 78, 71, 13, 10, 26, 10])) return "image/png";
-  if (startsWith(bytes, [255, 216, 255])) return "image/jpeg";
-  if (ascii(bytes, 0, 6) === "GIF87a" || ascii(bytes, 0, 6) === "GIF89a") return "image/gif";
-  if (ascii(bytes, 0, 4) === "RIFF" && ascii(bytes, 8, 12) === "WEBP") return "image/webp";
-  if (ascii(bytes, 0, 4) === "RIFF" && ascii(bytes, 8, 12) === "WAVE") return "audio/wav";
-  if (ascii(bytes, 0, 4) === "OggS") return "audio/ogg";
-  if (ascii(bytes, 0, 3) === "ID3" || startsWith(bytes, [255, 251])) return "audio/mpeg";
-  if (startsWith(bytes, [26, 69, 223, 163])) return "video/webm";
-  if (ascii(bytes, 4, 8) === "ftyp") return "video/mp4";
-  if (ascii(bytes, 0, 4) === "wOFF") return "font/woff";
-  if (ascii(bytes, 0, 4) === "wOF2") return "font/woff2";
-  return sniffSafeTextMime(bytes);
+function removeRelayItem(tags, expected) {
+  const url = expected[1];
+  const matching = tags.filter((tag) => sameRelay(tag, url));
+  if (matching.length === 0) return { tags, changed: false };
+  const retained = tags.filter((tag) => !sameRelay(tag, url));
+  if (expected.length === 2) return { tags: retained, changed: true };
+  const coverage = /* @__PURE__ */ new Set();
+  for (const tag of matching) for (const direction of relayCoverage(tag)) coverage.add(direction);
+  coverage.delete(expected[2]);
+  const rewritten = relayTag(url, coverage);
+  if (rewritten) retained.push(rewritten);
+  return { tags: retained, changed: true };
 }
-function sniffSafeTextMime(bytes) {
-  let text;
-  try {
-    text = UTF8_DECODER.decode(bytes);
-  } catch {
-    return null;
-  }
-  if (/\u0000/u.test(text)) return null;
-  const normalized = text.trimStart().toLowerCase();
-  if (normalized.startsWith("<svg") || normalized.startsWith("<?xml") || normalized.startsWith("<!doctype html") || normalized.startsWith("<html") || normalized.startsWith("<script")) return null;
-  if (normalized.startsWith("{") || normalized.startsWith("[")) {
+function metadataTags(resolved, options) {
+  const tags = [];
+  if (resolved.identifier) tags.push(["d", resolved.identifier]);
+  if (options?.title) tags.push(["title", options.title]);
+  if (options?.description) tags.push(["description", options.description]);
+  if (options?.image) tags.push(["image", options.image]);
+  return tags;
+}
+function listFilter(resolved, author) {
+  return {
+    kinds: [resolved.support.kind],
+    authors: [author],
+    limit: 16,
+    ...resolved.identifier ? { ["#d"]: [resolved.identifier] } : {}
+  };
+}
+function newestList(events, resolved, author) {
+  return events.filter((event) => event.kind === resolved.support.kind && event.pubkey.toLowerCase() === author && (!resolved.identifier || event.tags.some((tag) => tag[0] === "d" && tag[1] === resolved.identifier)) && verifyEvent(event)).sort((left, right) => right.created_at - left.created_at || left.id.localeCompare(right.id))[0] ?? null;
+}
+function createPajaListsBackend(options) {
+  const activeSigner = async () => {
+    const signer = options.getSigner();
+    if (!signer?.getPublicKey || !signer.signEvent) throw new Error("not-signed-in");
+    const pubkey2 = (await signer.getPublicKey()).toLowerCase();
+    if (!HEX_643.test(pubkey2)) throw new Error("not-signed-in");
+    return { signer, pubkey: pubkey2 };
+  };
+  const mutation = async (operation, ref, items, mutationOptions) => {
+    const resolved = resolveList(ref);
+    if ("ok" in resolved) return resolved;
+    if (items.length === 0) return { ok: true, [operation === "add" ? "added" : "removed"]: 0, skipped: 0 };
+    const itemTags = [];
+    for (const item of items) {
+      const tag = itemTag(resolved.support, item);
+      if (isFailure(tag)) return tag;
+      itemTags.push(tag);
+    }
+    let active;
     try {
-      JSON.parse(text);
-      return "application/json";
+      active = await activeSigner();
     } catch {
-      return "text/plain";
+      return failure2("not-signed-in", "list mutations require an active signer");
     }
-  }
-  return "text/plain";
+    let current;
+    try {
+      const events = await options.relay.query(
+        options.getRelays(),
+        [listFilter(resolved, active.pubkey)],
+        PAJA_LIVE_QUERY_WAIT_MS
+      );
+      current = newestList(events, resolved, active.pubkey);
+    } catch {
+      return failure2("list-unavailable", "current list could not be loaded");
+    }
+    if (!current && !(operation === "add" && mutationOptions?.create)) {
+      return failure2("list-not-found", "list does not exist and creation was not requested");
+    }
+    if (operation === "remove" && current?.content && items.some((item) => item.visibility !== "public")) {
+      return failure2("private-items-unsupported", "cannot safely remove private items without NIP-44 support");
+    }
+    let tags = current ? current.tags.map((tag) => [...tag]) : metadataTags(resolved, mutationOptions);
+    let changed = 0;
+    for (const expected of itemTags) {
+      if (resolved.support.kind === 10002) {
+        const result2 = operation === "add" ? addRelayItem(tags, expected) : removeRelayItem(tags, expected);
+        tags = result2.tags;
+        if (result2.changed) changed += 1;
+        continue;
+      }
+      if (operation === "add") {
+        if (!tags.some((tag) => sameItem(tag, expected))) {
+          tags.push(expected);
+          changed += 1;
+        }
+      } else {
+        const before = tags.length;
+        tags = tags.filter((tag) => !sameItem(tag, expected));
+        if (tags.length < before) changed += 1;
+      }
+    }
+    const skipped = items.length - changed;
+    if (changed === 0) {
+      return {
+        ok: true,
+        ...current ? { eventId: current.id, event: { ...current } } : {},
+        [operation === "add" ? "added" : "removed"]: 0,
+        skipped
+      };
+    }
+    try {
+      const template = {
+        kind: resolved.support.kind,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags,
+        content: current?.content ?? ""
+      };
+      const event = await active.signer.signEvent(template);
+      if (event.pubkey.toLowerCase() !== active.pubkey || !verifyEvent(event)) {
+        return failure2("publish-failed", "signer returned an invalid list event");
+      }
+      await options.relay.publish(options.getRelays(), event);
+      return {
+        ok: true,
+        eventId: event.id,
+        event: { ...event },
+        [operation === "add" ? "added" : "removed"]: changed,
+        skipped
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return failure2(message.includes("denied") ? "user-denied" : "publish-failed", message);
+    }
+  };
+  return {
+    supported: publicSupport,
+    add: (list, items, mutationOptions) => mutation("add", list, items, mutationOptions),
+    remove: (list, items, mutationOptions) => mutation("remove", list, items, mutationOptions)
+  };
 }
 
 // src/browser-webrtc.ts
@@ -18452,7 +18796,7 @@ var BrowserWebrtcController = class {
   };
   refreshAvailability() {
     const signer = this.options.getSigner();
-    const nextPubkey = isSignalingSigner(signer) ? normalizePubkey2(this.options.getPubkey()) : null;
+    const nextPubkey = isSignalingSigner(signer) ? normalizePubkey3(this.options.getPubkey()) : null;
     if (this.activePubkey !== nextPubkey) {
       this.dispose();
       this.activePubkey = nextPubkey;
@@ -18472,8 +18816,8 @@ var BrowserWebrtcController = class {
       throw new Error("session limit reached");
     }
     const signer = this.requireSigner();
-    const localPubkey = normalizePubkey2(await signer.getPublicKey());
-    if (!localPubkey || localPubkey !== normalizePubkey2(this.options.getPubkey())) throw new Error("signaling unavailable");
+    const localPubkey = normalizePubkey3(await signer.getPublicKey());
+    if (!localPubkey || localPubkey !== normalizePubkey3(this.options.getPubkey())) throw new Error("signaling unavailable");
     const identity = this.options.getIdentity(context.windowId);
     const allowed2 = await this.options.confirm({
       action: "webrtc",
@@ -18486,7 +18830,7 @@ var BrowserWebrtcController = class {
     const id = this.crypto.randomUUID();
     const channel = request.channel ?? "default";
     const roomHash = request.scope.type === "room" ? await hashRoom(this.crypto, request.scope.room) : void 0;
-    const allowedPeers = request.scope.type === "direct" ? /* @__PURE__ */ new Set([normalizePubkey2(request.scope.pubkey)]) : request.scope.peers && request.scope.peers.length > 0 ? new Set(request.scope.peers.map((peer) => normalizePubkey2(peer))) : null;
+    const allowedPeers = request.scope.type === "direct" ? /* @__PURE__ */ new Set([normalizePubkey3(request.scope.pubkey)]) : request.scope.peers && request.scope.peers.length > 0 ? new Set(request.scope.peers.map((peer) => normalizePubkey3(peer))) : null;
     const session = {
       id,
       windowId: context.windowId,
@@ -18663,7 +19007,7 @@ var BrowserWebrtcController = class {
   async publishPresence(session, type, recipient) {
     const tags = [["type", type]];
     if (recipient) tags.push(["p", recipient]);
-    else if (session.request.scope.type === "direct") tags.push(["p", normalizePubkey2(session.request.scope.pubkey)]);
+    else if (session.request.scope.type === "direct") tags.push(["p", normalizePubkey3(session.request.scope.pubkey)]);
     else if (session.allowedPeers) {
       for (const peer of session.allowedPeers) tags.push(["p", peer]);
     }
@@ -18720,7 +19064,7 @@ var BrowserWebrtcController = class {
   }
   requireSessionSigner(session) {
     const signer = this.requireSigner();
-    if (normalizePubkey2(this.options.getPubkey()) !== session.localPubkey) throw new Error("signaling unavailable");
+    if (normalizePubkey3(this.options.getPubkey()) !== session.localPubkey) throw new Error("signaling unavailable");
     return signer;
   }
   removePeer(session, pubkey2, notify) {
@@ -18766,12 +19110,12 @@ function validateOpenRequest(request) {
     throw new Error("unsupported scope");
   }
   if (request.scope.type === "direct") {
-    if (!normalizePubkey2(request.scope.pubkey)) throw new Error("unsupported scope");
+    if (!normalizePubkey3(request.scope.pubkey)) throw new Error("unsupported scope");
   } else if (request.scope.type === "room") {
     if (typeof request.scope.room !== "string" || request.scope.room.length < 8 || request.scope.room.length > 128) {
       throw new Error("unsupported scope");
     }
-    if (request.scope.peers && (request.scope.peers.length > PAJA_WEBRTC_MAX_PEERS || request.scope.peers.some((peer) => !normalizePubkey2(peer)))) throw new Error("unsupported scope");
+    if (request.scope.peers && (request.scope.peers.length > PAJA_WEBRTC_MAX_PEERS || request.scope.peers.some((peer) => !normalizePubkey3(peer)))) throw new Error("unsupported scope");
   } else {
     throw new Error("unsupported scope");
   }
@@ -18785,17 +19129,17 @@ function signalFilters(session) {
   return session.roomHash ? [{ ...base, "#r": [session.roomHash] }] : [{ ...base, "#p": [session.localPubkey] }];
 }
 function scopeAllowsPeer(session, pubkey2) {
-  return normalizePubkey2(pubkey2) !== null && pubkey2 !== session.localPubkey && (session.allowedPeers === null || session.allowedPeers.has(pubkey2));
+  return normalizePubkey3(pubkey2) !== null && pubkey2 !== session.localPubkey && (session.allowedPeers === null || session.allowedPeers.has(pubkey2));
 }
 function isSignalPayload(value, session) {
-  if (!isRecord5(value) || value.version !== 1 || typeof value.signalId !== "string") return false;
-  if (value.channel !== session.channel || value.protocol !== session.protocol || !isRecord5(value.description)) return false;
+  if (!isRecord6(value) || value.version !== 1 || typeof value.signalId !== "string") return false;
+  if (value.channel !== session.channel || value.protocol !== session.protocol || !isRecord6(value.description)) return false;
   return (value.description.type === "offer" || value.description.type === "answer") && typeof value.description.sdp === "string";
 }
 function isSignalingSigner(signer) {
   return typeof signer?.getPublicKey === "function" && typeof signer.signEvent === "function" && typeof signer.nip44?.encrypt === "function" && typeof signer.nip44.decrypt === "function";
 }
-function normalizePubkey2(value) {
+function normalizePubkey3(value) {
   return typeof value === "string" && /^[0-9a-f]{64}$/iu.test(value) ? value.toLowerCase() : null;
 }
 function describeScope(request) {
@@ -18822,7 +19166,7 @@ function tagValue2(tags, name) {
 function tagValues(tags, name) {
   return tags.filter((tag) => tag[0] === name && typeof tag[1] === "string").map((tag) => tag[1]);
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultPeerConnectionFactory() {
@@ -19617,7 +19961,7 @@ function createRuntimeSigner(getSimulation, confirmRequest, signerProvider, sour
   }
   return signer;
 }
-function createDevServices(backend, getSimulation, relayConfig, onThemeService, onThemeBroadcast, confirmRequest, getBlossomServers, uploadRuntime, signerProvider, intentHost, getIdentity, userActivation, notifyOptions, configOptions) {
+function createDevServices(backend, getSimulation, relayConfig, onThemeService, onThemeBroadcast, confirmRequest, getConfiguredBlossomServers, uploadRuntime, signerProvider, intentHost, getIdentity, userActivation, notifyOptions, configOptions) {
   const theme = createThemeService({
     initialTheme: createDevTheme(getSimulation().theme.mode, getSimulation().theme.values),
     onBroadcast: onThemeBroadcast
@@ -19628,6 +19972,11 @@ function createDevServices(backend, getSimulation, relayConfig, onThemeService,
   const getWriteRelays = () => relayConfig.getRelayUrls(["outbox"]);
   const getAllRelays = () => relayConfig.getRelayUrls();
   const baseOutboxRouter = createOutboxRouter(backend, getSimulation, relayConfig, confirmRequest, signerProvider);
+  const blossomEventResolver = createPajaBlossomEventResolver({
+    baseRouter: baseOutboxRouter,
+    getDefaultAuthors: () => [getRuntimePubkey(getSimulation, signerProvider)],
+    getConfiguredServers: getConfiguredBlossomServers
+  });
   const socialCache = createPajaSocialCache({
     baseRouter: baseOutboxRouter,
     loadContactList: createPajaContactListLoader(backend, getSimulation, signerProvider, getReadRelays),
@@ -19646,11 +19995,20 @@ function createDevServices(backend, getSimulation, relayConfig, onThemeService,
     getSigner: () => createRuntimeSigner(getSimulation, confirmRequest, signerProvider)
   });
   void socialCache.refreshActiveIdentity();
+  const resourceService = createResourceService({
+    fetch: createPajaResourceFetch({
+      getBlossomServers: ({ url, windowId }) => blossomEventResolver.getServers(url, windowId)
+    }),
+    resourceInfo: () => pajaResourceInfo()
+  });
   const services = {
-    resource: createResourceService({
-      fetch: createPajaResourceFetch({ getBlossomServers }),
-      resourceInfo: () => pajaResourceInfo(getBlossomServers())
-    })
+    resource: {
+      ...resourceService,
+      onWindowDestroyed(windowId) {
+        resourceService.onWindowDestroyed?.(windowId);
+        blossomEventResolver.clearWindow(windowId);
+      }
+    }
   };
   if (getSimulation().capabilities.domains.keys && typeof document !== "undefined") {
     services.keys = createKeysService({ listenerTarget: document });
@@ -19674,9 +20032,13 @@ function createDevServices(backend, getSimulation, relayConfig, onThemeService,
     });
     services.outbox = createOutboxService({
       router: baseOutboxRouter,
-      getQueryRouter: (windowId, context) => socialCache.decorate(
-        baseOutboxRouter,
-        () => context?.hasCapability(windowId, "identity:read") ?? false
+      getReadRouter: (windowId) => blossomEventResolver.decorate(baseOutboxRouter, windowId),
+      getQueryRouter: (windowId, context) => blossomEventResolver.decorate(
+        socialCache.decorate(
+          baseOutboxRouter,
+          () => context?.hasCapability(windowId, "identity:read") ?? false
+        ),
+        windowId
       )
     });
   }
@@ -19846,7 +20208,7 @@ function createPajaAdapter(config, getSimulation, onThemeService, onThemeBroadca
     getNappletIdentity: resolveIdentity,
     subscribeSignerChange: signerProvider?.subscribe?.bind(signerProvider)
   }) : void 0;
-  const getBlossomServers = () => [
+  const getConfiguredBlossomServers = () => [
     ...config.target?.pointer?.blossomServers ?? [],
     ...uploadRuntime?.getServers() ?? getSimulation().upload.servers
   ];
@@ -19859,7 +20221,7 @@ function createPajaAdapter(config, getSimulation, onThemeService, onThemeBroadca
     onThemeService,
     onThemeBroadcast,
     confirmRequest,
-    getBlossomServers,
+    getConfiguredBlossomServers,
     uploadRuntime,
     signerProvider,
     intentHost,
@@ -20388,14 +20750,14 @@ function createPajaPostMessageProxy(realWin, state, windowId) {
   return proxy;
 }
 function redactPajaMessageForLog(message) {
-  if (!isRecord6(message) || message.type !== "config.values") return message;
+  if (!isRecord7(message) || message.type !== "config.values") return message;
   return {
     type: "config.values",
     ...typeof message.id === "string" ? { id: message.id } : {},
     values: "[redacted by host]"
   };
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function installPajaOriginRegistryProxy(originRegistry2, stateRef) {
@@ -22166,7 +22528,7 @@ function createPajaConfigController(options) {
       const raw = storage.getItem(storageKey(options.getIdentity(windowId)));
       if (!raw) return cloneValues(options.getInitialValues?.(windowId) ?? {});
       const value = JSON.parse(raw);
-      return isRecord7(value) ? value : {};
+      return isRecord8(value) ? value : {};
     } catch {
       return {};
     }
@@ -22229,9 +22591,9 @@ function cloneValues(values) {
   }
 }
 function renderObjectFields(document2, parent, schema, values, path, bindings, selectedSection) {
-  const properties = isRecord7(schema.properties) ? schema.properties : {};
+  const properties = isRecord8(schema.properties) ? schema.properties : {};
   const required = new Set(Array.isArray(schema.required) ? schema.required.filter((key) => typeof key === "string") : []);
-  const ordered = Object.entries(properties).filter((entry) => isRecord7(entry[1])).filter(([, child2]) => !selectedSection || child2["x-napplet-section"] === selectedSection || child2.type === "object").sort(([leftKey, left], [rightKey, right]) => compareSchemaFields(leftKey, left, rightKey, right));
+  const ordered = Object.entries(properties).filter((entry) => isRecord8(entry[1])).filter(([, child2]) => !selectedSection || child2["x-napplet-section"] === selectedSection || child2.type === "object").sort(([leftKey, left], [rightKey, right]) => compareSchemaFields(leftKey, left, rightKey, right));
   for (const [key, rawChild] of ordered) {
     const child2 = rawChild;
     const childPath = [...path, key];
@@ -22329,7 +22691,7 @@ function assignPath(target, path, value) {
   let cursor = target;
   for (const segment of path.slice(0, -1)) {
     const child2 = cursor[segment];
-    if (!isRecord7(child2)) cursor[segment] = {};
+    if (!isRecord8(child2)) cursor[segment] = {};
     cursor = cursor[segment];
   }
   const final = path.at(-1);
@@ -22338,7 +22700,7 @@ function assignPath(target, path, value) {
 function readPath(values, path) {
   let cursor = values;
   for (const segment of path) {
-    if (!isRecord7(cursor)) return void 0;
+    if (!isRecord8(cursor)) return void 0;
     cursor = cursor[segment];
   }
   return cursor;
@@ -22380,7 +22742,7 @@ function readGlobalStorage() {
     return null;
   }
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }